Researchers have discovered spywaretargeting Android devices and presenting itself as an app, called “BMI CalculationVsn,” on the Amazon Appstore. Essentially, the spyware masquerades as a simple health tool, but in reality steals data from infected devices.
The app was discovered by researchers at McAfee Labs, who notified Amazon. The app has now been removed from the store.
However, those who have already installed the app should remove it manually and perform a full scan on the device to eliminate anything that may be left behind.
See also: Serbia used Israeli company's technology for spyware attacks
Android spyware on Amazon Appstore
The Amazon Appstore is an app store for Android devices that comes pre-installed tablets Amazon Fire and Fire TV devices.
Many Android users use it instead of Google Play, since it even offers exclusive games and Amazon Prime content.
The malicious BMI CalculationVsn application, which as we mentioned is spyware, has been published by "PT Visionet Data Internasional" and is promoted as a simple tool for calculating body mass index (BMI).
Opening the malicious application welcomes the user to a simple interface and displays the expected functionality. However, at the same time, malicious actions take place in the background.
First, the app activates a screen recording that requests the appropriate permission when the user clicks the “Calculate” button, which can mislead and trick people into spontaneous approvals.
See also: Gamaredon hackers use BoneSpy & PlainGnome spyware
McAfee researchers say the recording is stored locally in an MP4 file, but was not uploaded to the command and control (C2) server. This likely indicates that the application is in an early testing stage.
It appears that the app was released on October 8. By the end of the month, it had changed its icon, added more malicious features , and changed its certificate information.
In addition to screen recording, the app also scans the device to retrieve all installed applications, allowing attackers to plan their next steps.
Finally, the Android spyware, found on the Amazon Appstore, monitors and collects SMS messages sent and stored on the device, including one-time passwords (OTPs) and verification codes.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Protection from malicious applications
Although the Amazon Appstore has defense mechanisms, some malicious apps manage to sneak into the store. For this reason, users should always verify the authenticity of an app before installing it. This can be done reviews user.
Additionally, users can visit the official website of a service and find the link there to download the application from the app store.
See also: EagleMsgSpy: A spyware used by Chinese authorities
It's also important to check the permissions apps request, even if they're on the Amazon Appstore or other trusted stores. If an app asks for access to personal information that doesn't seem necessary for it to function, it's best to avoid installing it.
It is also essential to use reliable security software and regularly update the operating system and applications. Finally, users should avoid sharing their personal information with untrusted sources.
Source: www.bleepingcomputer.com
