Mobile malware attacks are becoming increasingly common as cybercriminals increasingly turn their attention to smartphones – ensuring that malicious activity is harder to detect.
According to data from the recently published McAfee Mobile Threat Report, the total number of detections for different types of mobile malware reached 35 million in the last quarter of 2019, up 10 million detections compared to 2018.
Analysis by McAfee researchers found that half of these detections were what are labeled as “stealth apps.” Malicious apps that are newly installed are designed to evade detection on the device and are therefore extremely difficult to remove.
The main goal of these applications is to “generate” money for the hacker, which often comes in the form of an infected device that downloads applications and automatically clicks on advertising links in the background or constantly bombards the user with pop-up advertising messages that cannot be dismissed.
"There are thousands of apps out there that actively hide their processes after installation. Of course, that makes it difficult for people to delete them," Raj Samani, chief scientist at McAfee, told ZDNet.
In order to avoid the security protections offered to Android users by the Google Play Store, cybercriminals are turning to other channels to help distribute their malicious apps. We often see hackers posting comments under YouTube or links to popular chat apps, such as Discord, claiming to offer free or “cracked” versions of well-known apps.
The download pages for these fake apps will use icons, text, and images of the real app to appear authentic and encourage potential victims to download the malware – but then the app will seemingly disappear after installation.
Apps sometimes simply hide in the phone menu, or the app will claim that it cannot be installed in the user's country – while secretly installing malware.
And because the app is hidden in such a way that the user is unlikely to find it, the malware will “drain” the phone’s battery by performing actions that will generate advertising.
Some hackers play an even bigger game, performing a few actions on an infected device over a long period of time, in order to keep the user unaware of their presence.
