Widely used Android apps infected with new Goldoson malware

SC StaffApril 20, 2023

Sixty-three legitimate apps in the Google Play Store with more than 100 million downloads have been compromised with the novel Goldoson Android malware, which could compromise app, Wi-Fi and Bluetooth-connected device, and GPS location data, The Hacker News reports. Aside from having ad fraud functionality, Goldoson could also facilitate stealthy web page loading through the execution of HTML code in an obscured WebView, a report from McAfee revealed. Google has already removed 36 of the compromised apps while the remaining apps have already been updated to eliminate Goldoson. The report should prompt increased transparency into software dependencies leveraged in mobile apps. "Attackers are becoming more sophisticated in their attempts to infect otherwise legitimate applications across platforms. The use of third-party SDKs and code, and their potential to introduce malicious code into otherwise legitimate applications is only continuing to grow as attackers start to target the software supply chain to gain the largest footprint possible," said Zimperium Vice President of Sales Engineering for the Americas Kern Smith.

SC Staff

Related

Golden Chickens malware developer unmasked

SC StaffMay 22, 2023

Golden Chickens malware developer unmasked SecurityWeek reports that Golden Chickens malware, which has been used by the Russian Cobalt Group and FIN6 cybercrime operations, had its second developer identified by eSentire to be a Romanian named Jack, also known as Lucky and badbullzvenom. Password stealers were Jack's main specialty when he began engaging in cybercrime as a teen, releasing the Voyer malware tool for exfiltrating Yahoo instant messages between 2007 and 2008, followed by the FlyCatcher tool for keystroke logging between 2008 and 2009, and the Con password stealer for browser, instant messenger, VPN, and FTP app credential theft in 2010, according to the eSentire report. Jack was noted by researchers to have met with Golden Chickens co-developer 'Chuck from Montreal' in the dark web from late 2012 to October 2013, before proceeding to release Multiplier and VenomKit in 2015 and 2017, respectively, which were later consolidated into Golden Chickens. "Security experts assert that in 2017 the Cobalt Group used badbullzvenoms (aka: Lucky) VenomKit to deploy Cobalt Strike in attacks on banks and then they used it again in 2018," said eSentire, which noted that the malware suite was leveraged by FIN6 in 2019, the same year when the suite included the PureLocker ransomware plugin.

Infostealers distributed via fraudulent CapCut websites

SC StaffMay 22, 2023

Different information-stealing malware strains have been distributed in separate campaigns leveraging websites masquerading as the TikTok video editor CapCut, according to BleepingComputer.

KeePass vulnerability puts master passwords at risk

SC StaffMay 21, 2023

Open source password manager KeePass is being impacted by a security flaw, tracked as CVE-2023-32784, which could be exploited to facilitate master password retrieval from program memory, SecurityWeek reports. "The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news