New Android spyware answers incoming calls

Share this article:
A malicious Android app that disguises itself as Google's new social networking platform, Google+, is capable of stealing data, and answering and recording incoming phone calls, researchers said this week.

The spyware app disguises itself as Google+ by installing itself with the name “Google ++,” Jamz Yaneza, threat research manager at Trend Micro, told SCMagazineUS.com on Monday.

The malware contained in the app shares the same code structure as previously discovered Android spyware that also can steal information and record phone calls made from infected devices. Unlike the older variants, however, the new variant can automatically answer incoming phone calls on versions 2.2 and earlier.

“Once it is installed you won't know it is doing anything malicious,” Yaneza said.

The malware automatically answers incoming phone calls made from a predefined number of the attacker's choosing. To conceal that it is answering a call, the malware first sets an infected device on silent mode and hides the dial pad. This allows attackers to stealthily eavesdrop on conversations occurring around the phone.

The app, which must be manually installed by a user to run, is currently being distributed on an unofficial Android  market, said Yaneza, who would not name the site. It is not available in the official Google Android Market.

In addition to spying on users, the app is also capable of stealing data from infected devices, including text messages, call logs and GPS locations.

Stolen data is sent to a remote server in China, Yaneza said. The app can also receive commands, but only when they are sent from the attacker's predefined number. 

A Google spokesperson did not immediately respond when contacted by SCMagazineUS.com on Monday.

Share this article:

Sign up to our newsletters

More in News

Research shows vulnerabilities go unfixed longer in ASP

Research shows vulnerabilities go unfixed longer in ASP

A new report finds little difference in the number of vulnerabilities among programming languages, but remediation times vary widely.

Bill would restrict Calif. retailers from storing certain payment data

The bill would ban businesses from storing sensitive payment data, for any long than required, even if it is encrypted.

Amplification, reflection DDoS attacks increase 35 percent in Q1 2014

Amplification, reflection DDoS attacks increase 35 percent in ...

The Q1 2014 Global DDoS Attack Report reveals that amplification and reflection distributed denial-of-service attacks are on the rise.