Hackers Compromise iOS & Android Devices by Launch Malicious APK & Drop Malware Over Hijacked WiFi Routers
Cyber criminals now attempt to compromise iOS & Android devices via advanced Phishing campaign that redirect iOS users to download malicious mobile APK that helps attackers to collect sensitive information and drop the Mobile malware.
Researchers believe that the attack belongs to Roaming Mantis campaign that uses DNS hijacking attack to hack Android smartphones, current attack carries updates on their tools and tactics.
In order to compromise iOS devices and collect the data, attackers let
iPhone user visit new landing page where the user forced to download the malicious iOS mobile config installation.
After the installation process, users redirect into the phishing site that automatically opens in a web browser and collected information from the device will be sent to the attacker’s server.
Once users enter their credentials then it redirects to the next page, which tried to steal the two-factor authentication code (PIN) sent to the device.
Malicious APK Targets an Android
Researchers discovered another malicious APK which is a variant of sagawa.apk, a malware that was earlier distributed via SMS in Japan.
According to Kaspersky, We also found out that the threat actors had compromised WiFi routers to overwrite DNS settings and discovered that the following two features were updated as well to compromise Android devices.:
- Decryption algorithm for encrypted payload in Trojan-Dropper module
- Stored destination and accounts for getting real C2
This new campaign affected many countries includes Russia, Japan, India, Bangladesh, Kazakhstan, Azerbaijan, Iran and Vietnam
Also, researchers detected this malware over 6,800 times for over 950 unique users during this period.
Beware …
- Change the default ID and password, and apply the relevant security patches to counter these threats;
- For Android users: do not download APKs from third-party sources;
- For iOS users: do not install a non-trusted third-party mobile config.
Indicator of Compromise:
| 417a6af1172042986f602cc0e2e681dc | APK file |
| 651b6888b3f419fc1aac535921535324 | APK file |
| 0a4e8d3fe5ee383ba3a22d0f00670ce3 | APK file |
| 870697ddb36a8f205478c2338d7e6bc7 | APK file |
| 7e247800b95c643a3c9d4a320b12726b | classes.dex |
| 7cfb9ed812e0250bfcb4022c567771ec | classes.dex |
| 8358d2a39d412edbd1cf662e0d8a9f19 | classes.dex |
| 7cfb9ed812e0250bfcb4022c567771ec | classes.dex |
| af2890a472b85d473faee501337564a9 | Decrypted dex file |
| c8d7475a27fb7d669ec3787fe3e9c031 | Decrypted dex file |
| d0848d71a14e0f07c6e64bf84c30ee39 | Decrypted dex file |
| e2b557721902bc97382d268f1785e085 | Decrypted dex file |
This post Hackers Compromise iOS & Android Devices by Launch Malicious APK & Drop Malware Over Hijacked WiFi Routers originally appeared on GB Hackers.
