Security News > 2020 > April > Sophisticated Android Spyware Attack Spreads via Google Play
Dubbed PhantomLance by Kaspersky, the campaign is centered around a complex spyware that's distributed via dozens of apps within the Google Play official market, as well as other outlets like the third-party marketplace known as APKpure.
Kaspersky's report follows previous research from BlackBerry, which connected OceanLotus to a trio of fake apps for Android last year.
The apps were distributed through phishing, but also to a wider set of targets via third-party app stores as well as the official Google Play Store.
BlackBerry researchers also dug into how the apps made it into the Google Play Store itself - "Finding that OceanLotus went to the trouble establishing an entire fake backstory to give its malicious apps an air of legitimacy," a spokesperson told Threatpost.
Kaspersky reported all discovered PhantomLance samples to the owners of legitimate app stores in which they were found, and Google Play has removed the known apps, but the campaign is ongoing, according to the firm.
News URL
https://threatpost.com/sophisticated-android-spyware-google-play/155202/
Related news
- New North Korean Android spyware slips onto Google Play (source)
- SpyLend Android malware downloaded 100,000 times from Google Play (source)
- Malicious Android 'Vapor' apps on Google Play installed 60 million times (source)
- Google fixes Android zero-days exploited in attacks, 60 other flaws (source)
- Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities (source)
- How Google tracks Android device users before they've even opened an app (source)
- Google fixes Android zero-day exploited by Serbian authorities (source)
- Google expands Android AI scam detection to more Pixel devices (source)
- Google Rolls Out AI Scam Detection for Android to Combat Conversational Fraud (source)
- Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos (source)