Security News > 2021 > April > Pre-Installed Malware Dropper Found On German Gigaset Android Phones
In what appears to be a fresh twist in Android malware, users of Gigaset mobile devices are encountering unwanted apps that are being downloaded and installed through a pre-installed system update app.
"The culprit installing these malware apps is the Update app, package name com.redstone.ota.ui, which is a pre-installed system app," Malwarebytes researcher Nathan Collier said.
The full list of devices that come with the pre-installed auto-installer includes Gigaset GS270, Gigaset GS160, Siemens GS270, Siemens GS160, Alps P40pro, and Alps S20pro+.
Unlike third-party apps downloaded from the Google Play Store, system apps cannot be easily removed from mobile devices without resorting to tools like Android Debug Bridge.
For its part, Gigaset confirmed the malware attack, stating that an update server used by the devices to fetch software updates was compromised and that only devices that relied on that specific update server were affected.
The development comes a week after cybersecurity researchers revealed a new Android malware that was found to pilfer users' photos, videos, and GPS locations by sending a fraudulent notification posing as a "System Update" that is "Searching for update."
News URL
Related news
- TrickMo malware steals Android PINs using fake lock screen (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Android malware "FakeCall" now reroutes bank calls to attackers (source)
- New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls (source)
- New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers (source)
- Cyber crooks push Android malware via letter (source)