Security News > 2021 > February > Android emulator supply-chain attack targets gamers with malware
ESET researchers have discovered that the updating mechanism of NoxPlayer, an Android emulator for Windows and macOS, made by Hong Kong-based company BigNox, was compromised by an unknown threat actor and used to infect gamers with malware.
NoxPlayer is used by gamers from over 150 countries around the globe according to BigNox but, as ESET found in January 2021, the supply-chain attack was focused on infecting only Asian gamers with at least three different malware strains.
"We have sufficient evidence to state that BigNox's infrastructure was compromised to host malware and also to suggest that their API infrastructure could have been compromised. In some cases, additional payloads were downloaded by the BigNox updater from attacker-controlled servers," ESET researcher Ignacio Sanmillan said.
The malicious updates delivered through NoxPlayer's compromised update mechanism included an unknown malware with monitoring capabilities and the extensively used Gh0st remote access trojan.
A third malware, the PoisonIvy RAT, was also discovered by ESET while investigating the supply-chain attack but this was delivered as a second-stage payload, from the attackers' own infrastructure not by deploying malicious NoxPlayer updates.
Despite the vast amount of victims that could've been infected between September 2020 when the supply-chain attack started and January 2021 when it was discovered, the NightScout threat actor instead chose to infect five targets from Taiwan, Hong Kong, and Sri Lanka, revealing this operation's highly-targeted nature.
News URL
Related news
- New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks (source)
- CISA warns of Microsoft Streaming bug exploited in malware attacks (source)
- Chinese State Hackers Target Tibetans with Supply Chain, Watering Hole Attacks (source)
- PixPirate Android malware uses new tactic to hide on phones (source)
- DarkGate Malware Exploited Recently Patched Microsoft Flaw in Zero-Day Attack (source)
- From Deepfakes to Malware: AI's Expanding Role in Cyber Attacks (source)
- New BunnyLoader Malware Variant Surfaces with Modular Attack Features (source)
- Over 100 US and EU orgs targeted in StrelaStealer malware attacks (source)
- Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others (source)
- Vultur banking malware for Android poses as McAfee Security app (source)