A major hacking campaign using malware has infected more than 10 million Android devices from over 70 countries. The campaign is likely responsible for stealing a huge amount of money, as the apps spreading the malware sign up victims to subscription services without them knowing . The malicious Android apps that managed to make it onto the Google Play Store distributed the GriftHorse malware, which was discovered by researchers at Zimperium zLabs .
See also: Apple and Google Stores: Apps for children had no privacy policy
This malware campaign was active for approximately five months, between November 2020 and April 2021.
GriftHorse was delivered to victims thanks to 200 trojanized Android applications that had been passed on to the official Google store (Play Store) and also to third-party app stores.
While Google they has removed the apps since being notified of their malicious nature, are still available for download in third-party stores.
According to researchers, the criminals could have stolen millions through the subscriptions that the victims paid each month without knowing it.
See also: More than 130,000 malicious IP addresses blocked ahead of the 2021 census
The criminals used the GriftHorse malware to infect their victims and sign them up for premium services to extort money from them.
The 200 trojanized Android apps were not detected by the vast majority of anti-malware software vendors and managed to evade detection for months while the GriftHorse campaign was active.
The researchers also noted that the 200 apps belonged to different categories to "hit" as many victims as possible.
After being installed on a victim's phone, these malicious apps were able to access the mobile phone number and use it to sign up unsuspecting victims to premium SMS services that charged more than €30 per month to their phone bills.
See also: FTC: Scammers target LGBTQ+ community on dating apps
Researchers estimate that over 10 million Android users have been affected by the malicious apps that existed on the Google Play Store and elsewhere, and that hundreds of millions of euros have been stolen.
Android malware: Stolen money is almost impossible to recover
Victims who didn't realize it right away (most likely those who made recurring payments through their bank accounts) paid for months, and unfortunately have little chance of getting their money back.
“Statistics reveal that more than 10 million Android users fell victim to this campaign worldwide, losing a lot of money, while the threat group became richer and more motivated over time“.
The full list of all trojanized applications used in the GriftHorse campaign is available at the end of Zimperium's report.
Source: Bleeping Computer
