These loan services, such as KreditApple and MoneyApe, operate outside the Play Store’s scrutiny, redirecting victims to external Amazon EC2 servers to download malicious APKs (KreditApple.apk with SHA-256 fa27aa603eb6807dbc60d5dadc5b8f9b9290099f). Cybersecurity firm CYFIRMA uncovered the operation, revealing a multi-layered attack designed to harvest sensitive data, deploy predatory loan services, and extort victims through blackmail. A sophisticated Android malware campaign dubbed “SpyLend” has infiltrated the Google Play Store, masquerading as a financial utility app to target Indian users. For Indian users, it launches a WebView component loading content from adv[.]rp5[.]org, a domain hosting unauthorized loan applications. A critical evasion tactic involves hosting loan apps on Amazon EC2 instances, bypassing Play Store vetting. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. While the security researchers noted that once installed, SpyLend requests invasive permissions—including access to call logs, SMS, contacts, and the clipboard—under the guise of identity verification. Disguised as “Finance Simplified” (package: com.someca.count), the app has amassed over 100,000 downloads since February 2025, leveraging its official platform presence to bypass user suspicion. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These APIs deliver loan parameters (interest rates, repayment methods) and track user interactions through app/user/saveVisitor, exfiltrating device metadata and behavioral analytics. Despite Google’s Play Protect safeguards, SpyLend’s use of WebView-delivered content allows real-time payload updates, evading static analysis. Negative reviews on the Play Store highlight complaints of data misuse, though the app remains available as of February 24, 2025. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. By dynamically injecting JavaScript code, SpyLend fetches loan application listings via endpoints such as app/product/app/list and app/loan/config. Users reporting harassment and blackmail cite threats involving manipulated photos, fake nude images, and demands for payment. CYFIRMA’s YARA rules (detecting hashes like 95a44305f9162352eddbb31e3ea03d7e) and MITRE ATT&CK mappings emphasize defense evasion (T1628) and credential access (T1414). As financial malware evolves, collaborative efforts between app stores and cybersecurity entities remain critical to disrupting these threats.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 24 Feb 2025 15:05:14 +0000