Android.Cynos.7.origin trojan infected +9 million Android devices

Researchers spotted dozens of games on Huawei’s AppGallery catalog containing the Android.Cynos.7.origin trojan.

Researchers from Dr. Web AV discovered 190 games on Huawei’s AppGallery catalog (i.e. simulators, platformers, arcades, strategies, and shooters) that were containing the Android.Cynos.7.origin trojan. They estimated that the malicious apps were installed on at least 9.300.00 Android devices. Experts state that some of these games target Russian-speaking users with Russian localization, titles, and descriptions, while others were designed to target Chinese or international audiences.

The Android.Cynos.7.origin is a modified version of the Cynos program module which can be integrated into Android apps to monetize them. The module is known since at least 2014, but experts pointed out that some versions implement aggressive features such as the capability to send premium SMS, intercept incoming SMS, download and launch extra modules, and download and install other apps.

The strain of malware analyzed by the researchers was designed to collect the information about users and their devices and displaying ads.

Dr. Web AV shared its findings with Huawei and helped the Chinese giant in removing the malicious apps from the AppGallery store.

Upon executing the tainted apps, they ask users for permission to make and manage phone calls. The malware can allow threat actors to steal the following data:

User mobile phone number
Device location based on GPS coordinates or the mobile network and Wi-Fi access point data (when the application has permission to access location)
Various mobile network parameters, such as the network code and mobile country code; also, GSM cell ID and international GSM location area code (when the application has permission to access location)
Various technical specs of the device
Various parameters from the trojanized app’s metadata

“At first glance, a mobile phone number leak may seem like an insignificant problem. Yet in reality, it can seriously harm users, especially given the fact that children are the games’ main target audience.” states the report.

“Even if the mobile phone number is registered to an adult, downloading a child’s game may highly likely indicate that the child is the one who actually using the mobile phone. It is very doubtful that parents would want the above data about the phone to be transferred not only to unknown foreign servers, but to anyone else in general.”

The games with the largest number of installations are listed below:

快点躲起来 (Hurry up and hide) – 2,000,000 installs
Cat game room – 427,000 installs
Drive school simulator – 142,000 installs

Below are the Indicators of compromise shared by the experts.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Android.Cynos.7.origin trojan)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.