New Malware Replaced Legit Android Apps With Fake Ones On 25 Million Devices

…Or the JioTV, AppLock, HotStar, Flipkart, Opera Mini or
Truecaller app—if you have installed any of these?

I’m asking this because cybersecurity researchers just yesterday
revealed eye-opening details about a widespread Android malware
campaign wherein attackers silently replaced installed legitimate
apps with their malicious versions on nearly 25 million mobile
phones.

Now the important question here is how they’re doing it and
why?

According to researchers at Check Point, attackers are
distributing a new kind of Android malware that disguises itself as
innocent-looking photo editing, adult entertainment, or gaming apps
and available through widely used third-party app stores.

Dubbed Agent Smith, the malware takes advantage of multiple
Android vulnerabilities, such as the Janus flaw and
the Man-in-the-Disk
flaw, and injects malicious code into the APK files of targeted
apps installed on a compromised device and then automatically
re-install/updates them without the victims’ knowledge or
interaction.

How Does Agent Smith Malware Work?

Upon installation of boobytrapped apps, the Agent Smith malware
leverages a three-stage infection chain and contains different
modules for each step, working of which are explained below:

1.) Loader Module — The initial app distributing the
malware contains a module called Loader, whose only purpose is to
decrypt, extract, and run the second stage module named Core.

2.) Core Module — Once executed, the Core module
communicates with the attackers’ C&C server to receive a list
of popular apps that needs to be targeted.

Further, to automatically install the modified APK and replace
its original version without users’ consent, attackers utilize a
series of 1-day vulnerabilities, including man-in-the-disk
attack^[5].

3.) Boot Module — This module is included in the
malicious payload that was bundled with the original app and worked
the same as the Loader module. It extracts and executes a malicious
payload, called the Patch module when a victim runs the modified
application.

4.) Patch Module — The patch module has been designed to
prevent modified applications from getting legitimate updates,
which if installed, would revert all malicious changes.

However, the researchers warn that this modular malware could be
easily adapted for far more intrusive and harmful purposes, such as
stealing sensitive information—from private messages to banking
credentials and much more.

Researchers initially encountered the Agent Smith malware in
early 2019, which was primarily being found targeting Android
devices in India (with 15 million infected devices) and other
nearby Asian countries like Pakistan, Bangladesh, Indonesia, and
Nepal.

Besides third-party app stores, researchers also found at least
11 infected apps on the Google Play Store in recent months
containing malicious yet inactive Agent Smith components.

This clearly indicates that the threat actors behind this malware
campaign are also trying to find a way in Google’s mobile app
download platform to spread their adware. Google has reportedly
removed all the apps from its store.

Since Agent Smith has mostly infected users who downloaded apps
from third-party app stores, users are highly recommended always to
download apps from trusted app stores to mitigate the risk of
infection. Also, download apps only from trusted developers.

Users are also advised to uninstall any apps they suspect may be
malicious by heading on to Settings Menu, clicking Apps or
Application Manager, and then Scroll to the suspected app and
uninstall it.

Since the key vulnerability Agent Smith is exploiting dates back
to 2017 and has already been patched, mobile app developers are
recommended to implement the latest APK Signature Scheme V2 to
prevent malicious apps from leveraging Android’s Janus
vulnerability against their apps.

^[1][2][4]