Researchers at security firm ESET have discovered a new and dangerous Trojan that targets Android devices by downloading and installing malware. The trojan, identified by ESET security software as Android/TrojanDownloader.Agent.JI, spreads via compromised websites and masquerades as a Flash Player update.
This is one of the Android threats that ESET will be showcasing at Mobile World Congress.
Once installed, the malware creates a fake battery-saving service on Android, prompting the victim to grant it access to Android Accessibility features. If the user grants permission to the “Monitor your actions”, “Retrieve window content” and “Turn on Explore by Touch” , the attacker can mimic the user’s actions by displaying whatever they want on the screen.
" In cases we investigated, this trojan was created to download another trojan designed to extort money from bank accounts. However, just a small change in the code would mean infecting the user with spyware or ransomware," warns Lukáš Štefanko, Malware Researcher at ESET, who led the analysis.
The main indication that a device is infected with malware is the presence of the “Saving Battery” option among the services in the Accessibility menu. In such a case, the user should either use a reliable mobile security application, such as ESET Mobile Security & Antivirus, to remove the threat, or uninstall the application by going to Settings -> Application Manager -> Flash-Player.
In case the user has been tricked into granting the application device administration rights, it is necessary to first disable the administrator rights by going to Settings -> Security -> Flash-Player.
"Unfortunately, uninstalling the downloader does not remove any malicious applications it may have already installed. As with the downloader, the best way to clean your device is to use a mobile security solution," recommends Lukáš Štefanko.
ESET experts have prepared a series of key tips to prevent infection by malware that attacks mobile devices:
- Only download applications or updates from a trusted source – in the case of the Adobe Flash Player update, the only safe place is the official Adobe site. Always check the URL in your browser
- Pay attention to the access and permissions your apps request.
- Use a reliable Mobile Security solution.
Those interested can find more information about the dangerous downloader or about ESET's preventive technology. ESET experts will be at this year's Mobile World Congress offering information on mobile security.
