Security News > 2023 > July > New Android malware uses OCR to steal credentials from images
Two new Android malware families named 'CherryBlos' and 'FakeTrade' were discovered on Google Play, aiming to steal cryptocurrency credentials and funds or conduct scams.
The malicious apps use various distribution channels, including social media, phishing sites, and deceitful shopping apps on Google Play, Android's official app store.
CherryBlos uses a range of tactics to steal cryptocurrency credentials and assets, with the main tactic being to load fake user interfaces that mimic official apps to phish for credentials.
Trend Micro analysts found connections to a campaign on Google Play, where 31 scam apps collectively called "FakeTrade" were using the same C2 network infrastructures and certificates as the CherryBlos apps.
Google told BleepingComputer that the reported malware apps had been removed from Google Play.
Anatsa Android trojan now steals banking info from users in US, UK. SpinOk Android malware found in more apps with 30 million installs.
News URL
Related news
- SpyLend Android malware downloaded 100,000 times from Google Play (source)
- Vo1d malware botnet grows to 1.6 million Android TVs worldwide (source)
- BadBox malware disrupted on 500K infected Android devices (source)
- North Korea’s ScarCruft Deploys KoSpy Malware, Spying on Android Users via Fake Utility Apps (source)
- New Android malware uses Microsoft’s .NET MAUI to evade detection (source)
- APT36 Spoofs India Post Website to Infect Windows and Android Users with Malware (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials (source)
- New Crocodilus malware steals Android users’ crypto wallet keys (source)
- Counterfeit Android devices found preloaded With Triada malware (source)