SpyNote: A new and powerful Android Trojan has been leaked to various underground forums, making it free for less skilled hackersto use in attacks.
The Trojan app is called SpyNote and allows hackers to steal users' messages and contacts, listen to their calls, record audio using the device's built-in microphone, control the device's camera, and more.
According to researchers from Palo Alto Networks, SpyNote does not require root on a device, but prompts users for a long list of installation permissions. The Trojan can also automatically update and install other malicious applications on the device.
It is unclear how the attackers intend to distribute it to victims, as researchers have not yet observed any attacks. However, with the release of the SpyNote builder, it is very likely that an attack will be detected soon.
The builder is a Windows application that can be used to create customized versions of the SpyNote APK ( Android application package ) malware . Attackers can modify parameters such as the application's name, icon, and command server.
Most malicious Android apps are distributed by third-party websites and installed on devices from “unknown sources.” This feature is disabled by default on Android devices.
Of course, sometimes, malware overcomes Google and finds a place in the Play Store.
Another possibility is the manual installation of the Trojan application on an unattended device. There have been cases where users have received pre-infected devices as gifts from people who wanted to spy on them.
Newer versions of Android have anti-malware like Verify Apps and SafetyNet that can detect and block known malware applications.
As a general rule, installing apps from third-party sources can be very risky – these sources often lack the governance provided by official sources, such as the Google Play Store, which, even with detailed procedures and algorithms to eliminate malicious apps, is not impenetrable.
