Threats Tagged 't1541'

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft, targeting sensitive financial information such as banking credentials, debit card details, and OTPs. It exploits device resources for mining while maintaining persistence through advanced hiding techniques and resisting removal. The malware abuses permissions to access SMS, calls, and storage, enabling comprehensive data exfiltration. It uses Firebase for command-and-control and data exfiltration, masking malicious activity within legitimate cloud traffic. Its modular design includes WebView-based phishing pages aimed at financial fraud and identity theft. The malware infrastructure involves recently registered domains and obfuscation services, indicating a professional operation. GhostGrab exemplifies the convergence of financial cybercrime and resource exploitation in mobile malware, posing a significant threat to Android users. European organizations with mobile banking users are at risk, especially where Android market share is high. Mitigation requires enhanced mobile security controls, user awareness, and network monitoring for suspicious Firebase traffic.

MediumMalwareGermanyFranceItaly+5#ghostgrab#cryptocurrency mining#banking trojan

Two Android spyware campaigns, ProSpy and ToSpy, have been discovered targeting users in the United Arab Emirates. These campaigns impersonate secure messaging apps like Signal and ToTok, distributing malware through deceptive websites and social engineering tactics. Once installed, the spyware exfiltrates sensitive data including contacts, SMS messages, files, and device information. The campaigns use persistence mechanisms to ensure continuous operation on compromised devices. ProSpy disguises itself as encryption plugins or pro versions of apps, while ToSpy exclusively mimics the ToTok app. The malware is distributed through unofficial sources, highlighting the risks of downloading apps outside official app stores.

MediumPhishingUnited Arab EmiratesUnited KingdomGermany+2#data exfiltration#android/spy.tospy#signal