Security News > 2020 > April > Sophisticated Android Spyware Attack Spreads via Google Play
Dubbed PhantomLance by Kaspersky, the campaign is centered around a complex spyware that's distributed via dozens of apps within the Google Play official market, as well as other outlets like the third-party marketplace known as APKpure.
Kaspersky's report follows previous research from BlackBerry, which connected OceanLotus to a trio of fake apps for Android last year.
The apps were distributed through phishing, but also to a wider set of targets via third-party app stores as well as the official Google Play Store.
BlackBerry researchers also dug into how the apps made it into the Google Play Store itself - "Finding that OceanLotus went to the trouble establishing an entire fake backstory to give its malicious apps an air of legitimacy," a spokesperson told Threatpost.
Kaspersky reported all discovered PhantomLance samples to the owners of legitimate app stores in which they were found, and Google Play has removed the known apps, but the campaign is ongoing, according to the firm.
News URL
https://threatpost.com/sophisticated-android-spyware-google-play/155202/
Related news
- Android malware 'Necro' infects 11 million devices via Google Play (source)
- Fake WalletConnect app on Google Play steals Android users’ crypto (source)
- Google: Gemini AI for Android processes sensitive data locally (source)
- Google says it's focusing on privacy with Gemini AI on Android (source)
- Google raps Iran's APT42 for raining down spear-phishing attacks (source)
- Google to Remove App that Made Google Pixel Devices Vulnerable to Attacks (source)
- Google fixes ninth Chrome zero-day exploited in attacks this year (source)
- Google Removing Poor-Quality Android Apps From Play Store to Boost Engagement (source)
- Google backports fix for Pixel EoP flaw to other Android devices (source)
- New Octo Android malware version impersonates NordVPN, Google Chrome (source)