{"id":18543,"date":"2022-03-03T19:53:12","date_gmt":"2022-03-03T19:53:12","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/03\/this-android-malware-has-been-downloaded-10000-times\/"},"modified":"2022-03-03T19:53:12","modified_gmt":"2022-03-03T19:53:12","slug":"this-android-malware-has-been-downloaded-10000-times","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/03\/03\/this-android-malware-has-been-downloaded-10000-times\/","title":{"rendered":"This Android Malware Has Been Downloaded 10,000 Times"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
\"Malware
Suttipun\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

Every so often, an app gets on Google Play that manages to trick users into downloading malware. That\u2019s exactly what happened with a recent app that installed a remote access trojan that swiped passwords, text messages, and other personal data.<\/p>\n

The trojan<\/a> is called either TeaBot or Anatsa and it first started appearing in May 2021. It lets the malicious individual remotely view the screens of infected devices and interact with operations carried out by the device\u2019s owner.<\/p>\n

As reported by security firm\u00a0Cleafy<\/a>, the TeaBot malware is back in an Android app called\u00a0QR Code & Barcode Scanner. The researchers informed Google of the malicious application and the app was removed from Google Play. However, it was already downloaded more than 10,000 times before it was pulled. If you have this app on your phone, delete it immediately.<\/p>\n

\u201cTeaBot RAT capabilities are achieved via the device screen\u2019s live streaming (requested on-demand) plus the abuse of Accessibility Services for remote interaction and key-logging. This enables Threat Actors (TAs) to perform ATO (Account Takeover) directly from the compromised phone, also known as \u2018On-device fraud\u2019,\u201d said Cleafy\u2019s report.<\/p>\n

Once the app is installed, it\u2019ll immediately request an update through an outside service, which is where it installs the malware and what allows it to get around Google Play\u2019s security.<\/p>\n

The new version of the trojan can target\u00a0home banking applications, insurances applications, crypto wallets, and crypto exchanges. The original incarnation could target approximately 60 apps and now it can get more than 400.<\/p>\n

This is a scary RAT malware<\/a> and serves as a reminder to be careful what you install on your phone.<\/p>\n

RELATED:<\/strong> What is RAT Malware, and Why Is It So Dangerous?<\/em><\/strong><\/a><\/p>\n<\/div>\n