Pre-Installed Malware Dropper Found On German Gigaset Android Phones

In what appears to be a fresh twist in Android malware, users of
Gigaset mobile devices are encountering unwanted apps that are
being downloaded and installed through a pre-installed system
update app.

“The culprit installing these malware apps is the Update app,
package name com.redstone.ota.ui^[1], which is a
pre-installed system app,” Malwarebytes researcher Nathan Collier
said^[2]. “This app is not only
the mobile device’s system updater, but also an auto installer
known as Android/PUP.Riskware.Autoins.Redstone.”

The development was first reported^[3]
by German author and blogger Günter Born last week.

While the issue seems to be mainly affecting Gigaset phones,
devices from a handful of other manufacturers appear to be impacted
as well. The full list of devices that come with the pre-installed
auto-installer includes Gigaset GS270, Gigaset GS160, Siemens
GS270, Siemens GS160, Alps P40pro, and Alps S20pro+.

According to Malwarebytes, the Update app installs three
different versions of a trojan (“Trojan.Downloader.Agent.WAGD”)
that’s capable of sending SMS and WhatsApp messages, redirecting
users to malicious game websites, and downloading additional
malware-laced apps.

“The malicious WhatsApp messages are most likely in order to
further spread the infection to other mobile devices,” Collier
noted.

Users have also reported experiencing a second trojan called
“Trojan.SMS.Agent.YHN4” on their mobile devices after landing on
gaming websites redirected by the aforementioned WAGD trojan, which
mirrors the latter’s SMS and WhatsApp messaging functionality to
propagate the malware.

Unlike third-party apps downloaded from the Google Play Store,
system apps cannot be easily removed from mobile devices without
resorting to tools like Android Debug Bridge (ADB^[4]).

For its part, Gigaset confirmed the malware attack, stating that
an update server used by Gigaset devices to fetch software updates
was compromised and that only devices that relied on that specific
update server were affected. The company has since fixed the issue
and is expected to push an update to remove the malware from
infected phones, according^[5]
to Born.

The development comes a week after cybersecurity researchers
revealed a new Android malware^[6]
that was found to pilfer users’ photos, videos, and GPS locations
by sending a fraudulent notification posing as a “System Update”
that is “Searching for update.”