60,000 Android Devices are Infected with Malicious Battery Saver App that Steal Various Sensitive Data

Over 60,000 Android devices are infected with malicious Battery Saver app that is capable of stealing sensitive information from victims and generating revenue through ads.

Fake scam web page advertisements are posting in various forums which is related to pharmaceutical ads, and phony prizes scams with malicious links that lead to installing nasty apps.

Scams are pointing to other web pages that scary users in many other ways  ‘you need to update your device!’ or ‘you need to install this antivirus to save your device!’.

These malicious web page not only play the role to generate ads revenue but it also will perform the malicious information stealing actvities.

Researchers from RiskIQ attempt to crawl malicious web page to identify the potential scams and find one redirection that redirect victims who click to Google Play, where they are served as a malicious app.

How Does it Works

The scam page code is a very direct way to reach victims and there is no attempts at obfuscation techniques and initially, it checks the user’s language.

if it doesn’t find any languages then select the English as a default language and once the language setting will be completed then it leads to popup the following page.

Later it forces vicitms to click the install to clean the desktop but if the user clicks on the ‘install’ or ‘cancel’ buttons, a user gets sent to another server owned by the operators which forward us to the Google Play store.

Finally, it landing the battery saving ad-clicker and it seeking the following device permission while user download and trying to install it.

• Read sensitive log data
• Receive text messages (SMS)
• Receive data from Internet
• Pair with Bluetooth devices
• Full network access
• Modify system settings

According to RiskIQ, interesting to note is that the app does actually perform the functions it mentions:

• Reduces battery strain in an attempt to lengthen the life of the battery
• Kills off processes using a lot of battery resources during low battery charge
• Monitors battery status

Currently, this app installed around 60,000 users device and it also controlled by around 15 bots via C&C server, so it had at least 60,000 android devices under its control.

SHARE

Milan Tomic

Hi. I’m Designer of Blog Magic. I’m CEO/Founder of ThemeXpose. I’m Creative Art Director, Web Designer, UI/UX Designer, Interaction Designer, Industrial Designer, Web Developer, Business Enthusiast, StartUp Enthusiast, Speaker, Writer and Photographer. Inspired to make things looks better.

• 
• 
• 
• 
•