CopyCat malware infected 14 mn Android devices, stole $1.5 mn


London, July 8 (IANS): A CopyCat malware affected over 14 million Android devices last year, rooting eight million of them and earning the hackers behind the attack approximately $1.5 million in fake ad revenues in two months, Israel-based IT security provider Check Point has revealed.

The malware affected users mainly in Southeast Asia and spread to more than 2,80,000 Android users in the US, the company said in a blog post.

"It is unclear who is behind the CopyCat attack, however, there are several connections to MobiSummer, an ad network located in China," it added.

"The malware also refrains from targeting Chinese devices, suggesting the malware developers are Chinese and want to avoid any investigation by local law enforcement, a common tactic in the malware world," the blog post said.

The malware uses a novel technique to generate and steal ad revenues.

According to the researchers, the campaign was spread via popular apps, repackaged with the malware and downloaded from third party app stores, as well as phishing scams. 

There was no evidence that CopyCat was distributed on Google Play Store.

In March this year, Check Point informed Google about the CopyCat campaign and how the malware operated. 

According to Google, they were able to quell the campaign, and the current number of infected devices is far lower than it was at the time of the campaign's peak. 

"Unfortunately, devices infected by CopyCat may still be affected by the malware even today," Check Point said.

The malware uses state-of-the-art technology to conduct various forms of ad fraud. 

Upon infection, CopyCat first roots the user's device, allowing the attackers to gain full control of the device and essentially leaving the user defenceless, reseachers said.

CopyCat then injects code into the Zygote app launching process, allowing the attackers to receive revenues by getting credit for fraudulently installing apps by substituting the real referrer's ID with their own, Check Point explained in a blogpost.

The CopyCat campaign reached its peak between April and May in 2016. 

  

Top Stories


Leave a Comment

Title: CopyCat malware infected 14 mn Android devices, stole $1.5 mn



You have 2000 characters left.

Disclaimer:

Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.