The Android 'SpyNote' malware was observed in attacks targeting Italy using a fake 'IT-alert' public alert service that infected visitors with the information-stealing malware. IT-alert is a legitimate public service operated by the Italian government, specifically the Department of Civil Protection, to provide emergency alerts and guidance to the population during imminent or ongoing disasters such as wildfires, floods, earthquakes, etc. Italian researchers at the D3Lab first spotted the fake IT-alert site, which is warning of an elevated possibility of an upcoming volcano eruption, urging visitors to install the app to remain informed. If the download button is clicked from an iOS device, the user is redirected to the real IT-alert site, but Android users attempting to download the app directly receive 'IT-Alert. The APK file installs SpyNote malware on the device, granting it permission to use Accessibility services, which enable the attackers to perform a wide range of dangerous and invasive actions on the compromised device. SpyNote can also perform overlay injection attacks to steal user credentials when the victim opens banking, cryptocurrency wallet, and social media applications. Other documented capabilities of the particular malware include camera recording, GPS and network location tracking, standard keylogging, screenshot capturing, phone call recording, and targeting Google and Facebook accounts. The SpyNote Android malware was first documented in 2022 and is now in its third major version, which is sold to cybercriminals through Telegram. In January 2023, a ThreatFabric report warned that SpyNote detections spiked following the source code leak of one of its variants, codenamed 'CypherRat. Some of those who got their hands on the leaked source code created custom variants targeting specific banks, while others opted to masquerade it as Google's Play Store, Play Protect, WhatsApp, and Facebook. Late last week, a report from F-Secure highlighted the rising prominence of SpyNote, providing a detailed analysis of its features and capabilities. To defend from these threats, avoid downloading and installing APKs from outside the Play Store unless you specifically trust the publisher. Fake 'RedAlert' rocket alert app for Israel installs Android spyware. Roid malware Xenomorph runs new campaign targeting the U.S. Trojanized Signal and Telegram apps on Google Play delivered spyware. GRU hackers attack Ukrainian military with new Android malware. New Android MMRat malware uses Protobuf protocol to steal your data.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 30 Nov 2023 23:19:27 +0000