Legit Android apps poisoned by sticky ‘Zombinder’ malware

Threat researchers have discovered an obfuscation platform that attaches malware to legitimate Android applications to lure users to install the malicious payload and make it difficult for security tools to detect.

Analysts with cybersecurity vendor ThreatFabric found the platform, named “Zombinder,” on the darknet while investigating a campaign that targeted both Android and Windows users with different types of malware.

Zombinder came to light while the researchers were analyzing a campaign involving the Ermac Android banking trojan. That effort yielded evidence of another campaign using multiple trojans aimed at both Android and Windows systems. Along with Ermac, it was distributing desktop malware including Erbium, Aurora stealer, and Laplas clipper.

“While investigating Ermac’s activity, our researchers spotted an interesting campaign masquerading as applications for Wi-Fi authorization,” the researchers write. “It was distributed through a fake one-page website containing only two buttons.”

It was distributed through a fake one-page website containing only two buttons

The buttons offered downloads for either Windows or Android. Clicking the latter downloaded Ermac, which can steal Gmail messages, two-factor authentication codes, and seed phrases from cryptocurrency wallets. It’s also a keylogger.

“However, another detail drew our attention: some of the downloaded apps were not directly Ermac, but a ‘legitimate’ app that, during its normal operation, installed Ermac as payload targeting multiple banking applications,” the researchers say.

These apps essentially were modified versions of legitimate apps, from a football streaming service to a Wi-Fi authenticator tool. The malware packages

Read more

Explore the site

More from the blog

Latest News