https://www.facebook.com/1398069260445816/

Hack-Tech community

Home
India
Kanpur
Hack-Tech community

information and updates only
(10)

Address

Delhi
Kanpur

Website

Alerts

Be the first to know and let us send you an email when Hack-Tech community posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Hackers Take Complete Control of Your Android Device by Launching MobOk Malware via Fake Photo Editing Apps in Google Play

Researchers discovered a fake photo editing apps which are used by cybercriminals to launch MobOk Malware that takes complete control of the infected Android device.

Threat actors are targeting Android users through legitimate Google play store app and hiding this malware to steal money by letting users subscribe to premium services.

Two photo editor apps were uncovered ‘Pink Camera’ and ‘Pink Camera 2’ which has been installed nearly 10, 000 times.

These apps were intended for uploading in the Google play store to steal personal data from victims Android device and use that to sign them up to paid subscription services.

Researchers described this MobOk malware as a powerful backdoor since it has sophisticated capabilities to take almost complete control over the infected Android device.

Developers of this Pink Camera apps added evasion techniques to hide suspicious activities and avoid detection. The apps included a genuine photo editing functionality, and the users completely believe it since the app downloaded from the Google Play Store.

Once the app will be installed into the victims mobile, it requests to grant permission for the notification from the user and perform malicious activities in the background.

The primary motivation of these apps has subscribed the user to paid mobile subscription services.

MobOk Malware Infection Process

After the complete infection, MobOk malware starts collecting the device information, including phone number and the attackers send the webpage for the premium subscription, which requires users to pay for the service.

Meanwhile, The malware will open a secret browser in the background, and it uses the victim’s phone number that was already collected and the Malware would insert it into the “subscribe” field and confirm the purchase.