Android malware alerts: Stay up to date with the latest threats to your phone

Dutch security firm ThreatFabric has discovered a Google Chrome update that disguises itself as legitimate but installs the "Brokewell" trojan malware.

Once installed, this malware collects personal data, grants remote control of the device to attackers, and can spy on users. Additionally, "Brokewell" can access banking apps, posing a significant threat to victims by potentially wiping out their accounts.

The "Brokewell" trojan employs a deceptive Chrome browser update to dupe smartphone users into installing it, utilizing the "overlay" technique to capture login information for targeted applications like banking apps. Through "accessibility logging," the malware records various user interactions, sending this data to a command-and-control server, thereby compromising personal information. With stolen credentials, attackers can remotely control the victim's phone, making all downloaded apps vulnerable to exploitation.

The Android banking malware Vultur, first identified in 2021, has evolved with new capabilities, granting it greater control over infected devices, according to security company NCC Group. This upgraded version utilizes Android's Accessibility Services to bypass the Google Play Store, enhancing its remote control functionalities.

Vultur's distribution relies on social engineering tactics, tricking victims via SMS messages into installing it. These messages create urgency by falsely claiming unauthorized transactions, leading victims to download an app disguised as McAfee Security, which is actually the Brunhilda dropper.

Once installed, Vultur enables cybercriminals to perform various malicious activities, including manipulating device functions and stealing credentials, primarily targeting banking apps. Despite its sophistication, Google Play Protect offers automatic protection against known versions of Vultur, emphasizing the need for continued vigilance against such threats.

Doctor Web is an IT security provider, which recently discovered several new malicious applications in the Google Play Store. Combined together, the downloads of these apps amounted to more than 2 million.

Some of these apps are HiddenAds malware disguised as mobile games. However, once downloaded they try to hide themselves by adopting the same icon as the Google Play Store or by straight up becoming invisible.

InfoSec's SentinelLabs is a space where threat researchers can gather data together and expose malware, exploits, and cybercrime in general. One of their latest findings revealed three separate applications that disguise themselves as the YouTube app, two of which have the exact same name as the original version and one called Piya Sharma after a famous anchor of the same name.

The ones responsible for the malware, dubbed CapraRAT, is a group going by the name Transparent Tribe (APT36). Thankfully, the malicious apps cannot be found in the official Google store. Instead, they are spread via social media and fake landing pages.

The scariest part is that they ask for permission to access your camera, microphone, location, SMS, and more of the sort. Such level of access creates the perfect opportunity for info theft, and even though it is thought CapraRAT is intended to affect mainly government officials and for espionage, any regular person can still be affected by it.

The best way to avoid this would be to stick to using the official YouTube application or website. The version that these fake apps and landing pages take you to is generally more stripped down compared to the original one.