Article Details
Scrape Timestamp (UTC): 2023-12-27 15:59:21.353
Original Article Text
Click to Toggle View
New Xamalicious Android malware installed 330k times on Google Play. A previously unknown Android backdoor named 'Xamalicious' has infected approximately 338,300 devices via malicious apps on Google Play, Android's official app store. McAfee, a member of the App Defense Alliance, discovered 14 infected apps on Google Play, with three having 100,000 installs each. Even though the apps have since been removed from Google Play, users who installed them since mid-2020 might still carry active Xamalicious infections on their phones, requiring manual scans and cleanup. The most popular of the Xamalicious apps are the following: Also, a separate set of 12 malicious apps carrying the Xamalicious threat, for which download stats aren't available, are distributed on unofficial third-party app stores, infecting users via downloadable APK (Android package) files. According to McAfee's telemetry data, most infections were installed on devices in the United States, Germany, Spain, the U.K., Australia, Brazil, Mexico, and Argentina. The Xamalicious Android backdoor Xamalicious is a .NET-based Android backdoor embedded (in the form of 'Core.dll' and 'GoogleService.dll') within apps developed using the open-source Xamarin framework, making the analysis of its code more challenging. Upon installation, it requests access to the Accessibility Service, enabling it to perform privileged actions like navigation gestures, hide on-screen elements, and grant additional permissions to itself. After installation, it communicates with the C2 (command and control) server to fetch the second-stage DLL payload ('cache.bin') if specific geographical, network, device configuration, and root status prerequisites are met. The malware is capable of executing the following commands: McAfee has also found links between Xamalicious and an ad-fraud app called 'Cash Magnet,' which automatically clicks ads and installs adware on the victim's device to generate revenue for its operators. Therefore, it's possible that Xamalicious also performs ad fraud on infected devices, diminishing processor performance and network bandwidth. Although Google Play isn't immune to malware uploads, initiatives like the App Defense Alliance aim to detect and remove novel threats that appear on the app store, which isn't the case on unofficial and poorly moderated platforms. Android users should avoid downloading apps from third-party sources, limit themselves to essential apps, thoroughly read user reviews before installation, and conduct a comprehensive background check on the app's developer/publisher to limit malware infections on their mobile devices.
Daily Brief Summary
Previously undiscovered Android malware, 'Xamalicious,' has infected around 338,300 devices through Google Play.
McAfee identified 14 apps with the malware on the official store, with three apps reaching over 100,000 installs each.
The malicious apps have been removed, but users who downloaded them could still be infected and require manual device cleanup.
Infection rates were highest among users in the United States, Germany, Spain, and several other countries.
Xamalicious can access the Android Accessibility Service to perform advanced actions and downloads additional payloads for execution.
There is potential evidence linking Xamalicious to ad fraud activities, like in the case of the 'Cash Magnet' app.
The incident underscores the importance of downloading apps only from trusted sources and conducting due diligence on app reviews and developers to avoid malware infections.