Millions of Google Android users receive new emergency warning

This week’s new serious warning is aimed at smartphone users who have been tricked into installing malicious apps on their devices. But unlike other recent warnings, these apps are much harder to find and remove on your phone.

This holiday season, we’ve been receiving a lot of warnings about apps laced with SpyLoan and Xamalicious malware. In either case, the security company has published a helpful list of usually trivial apps that users can use to check their devices. Not this time.

A new report exposes copycat downloads that trick users into believing they are established apps and add-ons from major providers, and says that “WhatsApp, Telegram, and Signal clones and MODs remain popular vectors for malware.” ESET warns.

The popularity of such apps makes them “very attractive to threat actors looking for ways to sneak malware onto your device.” It could cost you not just yourself, but even your employer. There is… You should never ride it. ”

With Apple’s App Store famously locked down and Google’s even Lapse Store continuing to tighten its defenses, these malicious actors are resorting to social engineering tricks to gain access to you. These highly dangerous services can attack your email and messaging apps. Link. In that case, it often looks like it’s coming from a friend.

However, these apps may also appear in legitimate app stores. In any case, be it dangerous Telegram clients or WhatsApp add-ons, they all come with extreme health warnings. Messaging apps are the center of smartphones, and smartphones are the center of our lives. This is a great hunting ground for attackers.

As ESET’s Jake Moore told me, “The quest for the next sophisticated, secure, privacy-focused messaging app can come with a sting in the tail. Copycat apps are easy to create, but… , some app stores unfortunately provide expensive platforms for advertising to the masses. Furthermore, many people don’t like emails, messages, and other things that promise the ‘next best thing.’ We are also influenced by the platform.”

A malicious attacker with permission to access WhatsApp and manage your contact list and messages can steal your personal information or use your personal information and messaging credentials to transfer your contacts to other malware. They will go to great lengths to target you.

End-to-end encrypted messaging has provided all of us with a level of communications security that was unprecedented before WhatsApp made this available to everyone at all times. However, remember that your device is vulnerable. Intercepting encrypted communications is impossible in almost all situations, but obtaining everything contained on a compromised device is relatively child’s play.

ESET warns that “downloading and installing malicious apps on your phone can expose you or your employer to a variety of threats,” including: there is.

• Theft of personal data, banking information, other financial information, and identity that can be sold on the dark web.
• Your device gets infected with adware. This software can also continuously display unwanted ads and click through on your behalf.
• Device hijackers and spyware can steal messages, emails, and other personal information from your device.
• Ransomware that locks your device.
• A dialer that secretly calls premium rate numbers.
• Workplace credentials. Allow access to company systems.

As we’ve advised many times here, every app on your phone and in your life is a potential threat. Try to focus on what you need from developers you know. Avoid the temptation to stuff your phone with boring apps from seemingly small developers you’ve never heard of.

Most such apps are designed and operated by enterprising malware operators with simple financial motivations. But we’ve seen more sophisticated nation-state attacks using such ploys to target specific people, such as fake messaging apps targeting China’s ethnic minorities inspired by last year’s Bad Bazaar. Ta.

Of course, such tactics aren’t limited to messaging apps; fake banking apps are also very popular. If you receive an email or text message with new or updated apps and links that appears to come from your bank, don’t install them. Check the app store instead. Unsurprisingly, the crypto app wilderness is also a target-rich environment, as is the number of AI/ChatGPT apps currently doing the rounds with catchphrase not to be missed.

Here are five other simple rules worth following.

1. Please use the official app store. Don’t use third-party stores or change your device’s security settings to enable apps to load.
2. Check the developer in the app description. Is the developer someone you admire? Then check the reviews to see if they are genuine or fake.
3. Don’t give permissions to apps you don’t need. Flashlights and stargazing apps don’t require access to your contacts or phone. Also, never grant accessibility permissions that facilitate device control unless necessary.
4. Once a month, scan your phone and remove some apps that you no longer need or haven’t used in a long time.
5. Don’t install apps that link to established apps like WhatsApp unless you know they’re legitimate. Check out reviews and what people are saying online.

More than that, you should always take sensible precautions. Use biometric security whenever possible. However, remember to change his PIN on your phone regularly and never share or use it publicly if you can avoid it. Keep your OS up to date. Please use the automatic feature in settings. Also, to stay safe, don’t open attachments or click on unexpected links.

“Downloading and installing malicious apps on your phone can lead to many disasters, including personal data theft, banking information compromise, device performance degradation, intrusive adware, and even spyware that monitors your conversations and messages. may occur,” warns Moore.

Most of the issues highlighted in these fake app reports are related to Android devices, third-party stores, and sideloading. iOS is even more locked down. This shows that Apple is currently under pressure to open up iOS to third-party app stores. Maybe 2024 will be the year we become careful about what we wish for.