Tag Archives: Android

If you have an Android device be aware that there’s a new strain of malware out there. Called MasterFred this new malware utilizes well-constructed fake login overlays in order to steal the login and credit card information for Twitter Instagram and Netflix users.

A sample of the code was submitted to VirusTotal in June of 2021 when the malware was first spotted in the wild.

Independent analyst Alberto Segura shared a second sample online a week ago with the note that the malware he sampled was used against Android users in Turkey and Poland.

Avast Threat Labs got their hands on the sample and discovered APIs provided by the built-in Android Accessibility Service were utilized to display the malicious overlays.

Avast Threat Lab had this to say about their research:

“By utilizing the Application Accessibility toolkit installed on Android by default, the attacker is able to use the application to implement the Overlay attack to trick the user into entering credit card information for fake account breaches on both Netflix and Twitter.”

While not new or innovative it is a clever bit of code relying on elements native to the device under attack to help the malware accomplish its mission. That’s not to say that MasterFred isn’t innovative in other ways however. For instance it uses a dark web gateway called Onion.ws to deliver the login and credit card information it steals to its command and control server.

Note that briefly MasterFred was found on the Google Play store embedded in a legitimate app. That app was removed but given its presence there (however temporarily) it stands to reason that the hackers are also pushing their malware out to third party app vendor sites as well.

Stay vigilant. MasterFred certainly won’t be the last threat we see this year.

There’s a nasty new strain of malware you need to be aware of that targets Android devices. Don’t let the funny name fool you because AbstractEmu is a serious threat. Not only will it root an infected device but it will allow the controller of the malware to take total control of the device. It will alter its settings and attempt to evade detection via a combination of anti-emulation checks and code abstraction.

The new strain was discovered by security researchers at Lookout Threat Labs. They discovered it bundled with a collection of legitimate utility apps distributed via the Google Play Store and other third-party app repositories.

Google has removed the malware from the Play Store at this point but not before several thousand people had already downloaded it. The malware remains available on a few different third-party repositories. If you’re in the habit of picking up apps outside of the Play Store an extra measure of caution is prudent.

The team that discovered the new strain had this to say about it:

“AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading.

By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction.”

Needless to say the group behind AbstractEmu has some skill and some serious coding chops. Although the malware strain’s removal from the Google Play Store has limited the rate of its spread you can bet the threat group will be on the lookout for other opportunities.