Android Malware Campaign Leverages Money-Lending Apps to Blackmail Victims

Dec 15, 2022Ravie LakshmananMobile Security /

A previously undocumented Android malware campaign has been
observed leveraging money-lending apps to blackmail victims into
paying up with personal information stolen from their devices.

Mobile security company Zimperium dubbed the activity
MoneyMonger, pointing out the use of the cross-platform Flutter
framework^[1] to develop the apps.

MoneyMonger “takes advantage of Flutter’s framework to obfuscate
malicious features and complicate the detection of malicious
activity by static analysis,” Zimperium researchers Fernando
Sanchez, Alex Calleja , Matteo Favaro, and Gianluca Braga said^[2]
in a report shared with The Hacker news.

“Due to the nature of Flutter, the malicious code and activity
now hide behind a framework outside the static analysis
capabilities of legacy mobile security products.”

The campaign, believed to be active since May 2022, is part of a
broader effort previously disclosed^[3]
by Indian cybersecurity firm K7 Security Labs.

None of the 33 apps used in the deceptive scheme have been
distributed through the Google Play Store. The money lending
applications, instead, are available through unofficial app stores
or sideloaded to the phones via smishing, compromised websites,
rogue ads, or social media campaigns.

Once installed, the malware poses a risk as it’s designed to
prompt the users to grant it intrusive permissions under the
pretext of guaranteeing a loan, and harvest a wide range of private
information.

The collected data – which includes GPS locations, SMSes,
contacts, call logs, files, photos, and audio recordings – is then
used as a pressure tactic to force victims into paying excessively
high-interest rates for the loans, sometimes even in cases after
the loan is repaid.

To make matters worse, the threat actors subject the borrowers
to harassment by threatening to reveal their information, call
people from the contact list, and send abusive messages and morphed
photos from the infected devices.

The scale of the campaign is unclear owing to the use of
sideloading and third-party app stores, but the rogue apps are
estimated to have racked up over 100,000 downloads through the
distribution vector.

“The extremely novel MoneyMonger malware campaign highlights a
growing trend by malicious actors to use blackmail and threats to
scam victims out of money,” Richard Melick, director of mobile
threat intelligence at Zimperium, said in a statement.

“Quick loan programs are often full of predatory models, such as
high-interest rates and payback schemes, but adding blackmail into
the equation increases the level of maliciousness.”

The findings come two weeks after Lookout discovered^[4]
nearly 300 mobile loan applications on Google Play and Apple’s App
Store that collectively have more than 15 million downloads and
have been found engaging in predatory behavior.

These apps not only exfiltrate extraordinary volumes of user
data but also come with hidden fees, high-interest rates, and
payment terms that are used to strong-arm victims for payment on
fraudulent loans.

“They exploit victims’ desire for quick cash to ensnare
borrowers into predatory loan contracts and require them to grant
access to sensitive information such as contacts and SMS messages,”
Lookout noted late last month.

Developing countries are a prime^[5]
target^[6]
for dodgy loan apps, as digital lending has seen explosive growth
in markets like India, where people are unwittingly turning to such
platforms after being turned away by banks^[7]
for failing to meet income requirements.

The exploitative nature of the personal loan terms has also led
to multiple^[8]
incidents^[9]
of suicides^[10] in the country^[11], prompting the Indian
government to initiate work^[12] on an allowlist of
legal digital lending apps that are permitted in app stores.

Google, in August, disclosed^[13] it had removed more
than 2,000 credit disbursement apps from its Play Store in India
since the start of the year for violating its terms.

The government has also sought urgent strict action^[14] by law enforcement
agencies against loan apps, a majority^[15] of them^[16] Chinese-controlled^[17], that have been found
to use harassment, blackmail, and harsh recovery techniques.