Mobile Menace

Your phone is as much at risk of malware attacks as your main computer and it pays to be aware of what’s out there

While analysts figure out new methodologies for analysing malware and users begin to understand how all this works, cybercriminals are seeking new ways to hide in phones and compromise devices. The convoluted tricks used to increase the effectiveness of their attacks can be grouped into two distinct categories. Social engineering strategies seek to confuse users, while sophisticated technical mechanisms try to obstruct malware detection and analysis.

Fraud in the Play Store

Malware in the official Google store never stops appearing. For cybercriminals, sneaking their malicious applications into the marketplace of genuine apps is a victory, as they can reach more potential victims, with an almost rock-solid guarantee of more infections.

The fake developer accounts used to spread insecure or malicious apps try to look as similar as possible to real accounts, to dupe unsuspecting users. In a recent example, researchers discovered a fake app for updating WhatsApp, that used a Unicode character trick to give the impression of being distributed through the official account.

Another common practice is to make malware look like versions of apps – games, mostly – that have gained sudden popularity, which are either scheduled for release or are not available in official stores for certain countries. This happened with Pokémon GO, Prisma and Dubsmash, adding hundreds of thousands of infections worldwide.

Then there’s tapjacking, a technique that involves capturing a user’s screen taps by displaying two superimposed apps. Victims believe that they are tapping on the app that they are seeing, but they are actually tapping on the underlying app, which remains hidden from view.