Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A SpyLoan application called 'RapiPlata' was identified on a victim's device, having been downloaded by over 150,000 users from both Google Play and Apple App Store. The app, which ranked in the top 20 finance category in Colombia, had extensive access to sensitive user data, including SMS messages, call logs, calendar events, and installed applications. It uploaded this data to its servers, posing significant risks to users' privacy and financial security. The app's malicious behavior included harassing messages, unauthorized loan approvals, and data theft. Despite its removal from official app stores, it remains accessible through third-party websites. The app is part of a larger SpyLoan malware operation, with similarities to previously identified malicious apps.

The threat involves a malicious mobile application named 'RapiPlata,' part of the SpyLoan malware family, which was distributed via both the Google Play Store and Apple App Store before being removed. The app was downloaded by over 150,000 users, primarily in Colombia, where it ranked in the top 20 finance apps. RapiPlata masquerades as a legitimate loan application but performs extensive unauthorized data collection and malicious activities. It gains access to highly sensitive user data, including SMS messages, call logs, calendar events, and lists of installed applications. This data is exfiltrated to attacker-controlled servers, enabling privacy violations and potential financial fraud. The app also engages in harassing users with messages and can approve loans without user consent, indicating a direct financial impact on victims. Despite removal from official app stores, the app remains accessible through third-party websites, increasing the risk of continued infections. The malware shares characteristics with other SpyLoan variants, suggesting a coordinated campaign targeting mobile users with predatory lending and data theft objectives. The indicators of compromise include numerous file hashes and malicious domains used for command and control or data exfiltration. The threat does not require user authentication beyond installation and likely requires user interaction to install, but once installed, it operates stealthily to harvest data and conduct fraudulent activities. No known exploits in the wild are reported, but the app’s presence in official stores prior to removal highlights gaps in app store security and the potential for widespread impact.

Detailed information about Malicious Loan App Removed from iOS and Google Play App Store Posed Severe Risks to Users. Get real-time updates, technical details, 

Title	Severity	Type	Source	Date

Threats Tagged 'sms scanning'

Filter Threats

Threats Tagged 'sms scanning'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility