Security News > 2020 > April > Sophisticated Android Spyware Attack Spreads via Google Play
Dubbed PhantomLance by Kaspersky, the campaign is centered around a complex spyware that's distributed via dozens of apps within the Google Play official market, as well as other outlets like the third-party marketplace known as APKpure.
Kaspersky's report follows previous research from BlackBerry, which connected OceanLotus to a trio of fake apps for Android last year.
The apps were distributed through phishing, but also to a wider set of targets via third-party app stores as well as the official Google Play Store.
BlackBerry researchers also dug into how the apps made it into the Google Play Store itself - "Finding that OceanLotus went to the trouble establishing an entire fake backstory to give its malicious apps an air of legitimacy," a spokesperson told Threatpost.
Kaspersky reported all discovered PhantomLance samples to the owners of legitimate app stores in which they were found, and Google Play has removed the known apps, but the campaign is ongoing, according to the firm.
News URL
https://threatpost.com/sophisticated-android-spyware-google-play/155202/
Related news
- Google fixes Android zero-days exploited in attacks, 60 other flaws (source)
- Google: 97 zero-days exploited in 2024, over 50% in spyware attacks (source)
- Google Gemini's Astra (screen sharing) rolls out on Android for some users (source)
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)
- Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities (source)
- iOS devices face twice the phishing attacks of Android (source)
- Google adds Android auto-reboot to block forensic data extractions (source)
- New Android malware steals your credit cards for NFC relay attacks (source)
- Phishers abuse Google OAuth to spoof Google in DKIM replay attack (source)