Pierluigi Paganini
November 23, 2021
Researchers from Dr. Web AV discovered 190 games on Huawei’s AppGallery catalog (i.e. simulators, platformers, arcades, strategies, and shooters) that were containing the Android.Cynos.7.origin trojan. They estimated that the malicious apps were installed on at least 9.300.00 Android devices. Experts state that some of these games target Russian-speaking users with Russian localization, titles, and descriptions, while others were designed to target Chinese or international audiences.
The Android.Cynos.7.origin is a modified version of the Cynos program module which can be integrated into Android apps to monetize them. The module is known since at least 2014, but experts pointed out that some versions implement aggressive features such as the capability to send premium SMS, intercept incoming SMS, download and launch extra modules, and download and install other apps.
The strain of malware analyzed by the researchers was designed to collect the information about users and their devices and displaying ads.
Dr. Web AV shared its findings with Huawei and helped the Chinese giant in removing the malicious apps from the AppGallery store.
Upon executing the tainted apps, they ask users for permission to make and manage phone calls. The malware can allow threat actors to steal the following data:
“At first glance, a mobile phone number leak may seem like an insignificant problem. Yet in reality, it can seriously harm users, especially given the fact that children are the games’ main target audience.” states the report.
“Even if the mobile phone number is registered to an adult, downloading a child’s game may highly likely indicate that the child is the one who actually using the mobile phone. It is very doubtful that parents would want the above data about the phone to be transferred not only to unknown foreign servers, but to anyone else in general.”
The games with the largest number of installations are listed below:
Below are the Indicators of compromise shared by the experts.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Android.Cynos.7.origin trojan)
[adrotate banner=”5″]
[adrotate banner=”13″]
