{"id":22119,"date":"2022-12-09T00:06:23","date_gmt":"2022-12-09T00:06:23","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/09\/zombinder-service-allows-cybercriminals-to-easily-add-malware-to-legitimate-apps\/"},"modified":"2022-12-09T00:06:23","modified_gmt":"2022-12-09T00:06:23","slug":"zombinder-service-allows-cybercriminals-to-easily-add-malware-to-legitimate-apps","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/09\/zombinder-service-allows-cybercriminals-to-easily-add-malware-to-legitimate-apps\/","title":{"rendered":"‘Zombinder’ service allows cybercriminals to easily add malware to legitimate apps"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

A newly discovered service on the dark web has been found to allow cybercriminals to easily add malware to legitimate apps.<\/p>\n

Detailed<\/a>\u00a0today by researchers at ThreatFabric B.V., \u201cZombinder\u201d was discovered while researching several cases of threat actors using a form of Android banking malware known as Ermac. As the researchers dug further, they uncovered a campaign that employed several different types of malware targeting Android and Windows users, including Erbium, the Aurora stealer and Laplas \u201cclipper.\u201d<\/p>\n

Campaigns using various forms of malware installed on Android apps are nothing new and are sadly all too familiar in 2022, but where the story gets interesting is that the researchers traced the campaign back to a third-party darknet<\/a> service provider, which they dubbed Zombinder.<\/p>\n

Advertising on the dark web as an application programming interface binding service, Zombinder launched in March 2022 and is now believed to be used by different threat actors. In an advertisement on a hacking forum, those behind the service pitch it as offering a universal binder that would allow malware to be bound with almost any legitimate application.<\/p>\n

In its latest campaign, Zombinder has been distributing the Xenomorph banking malware under the guise of a VidMate application. Distribution involves the modified application being advertised and downloaded from a malicious website that mimics the original website of the application, with the victim tricked into visiting the site through malicious ads.<\/p>\n

Varying from other malicious campaigns where apps don\u2019t work, the Zombinder-infected application works as advertised. The victims remain unaware that they have also been infected by malware.<\/p>\n

Although Android apps are the core focus of Zombinder, those behind the service also offer binding for Windows apps. Potential victims who download an infected Windows app also download the Erbium stealer, a popular form of Windows malware that steals saved passwords, credit card details, cookies and cryptocurrency wallet data.<\/p>\n

\u201cAndroid users can avoid Zombinder and similar malware by avoiding third-party app and APK download sites,\u201d\u00a0Paul Bischoff, privacy advocate with tech research company\u00a0Comparitech Ltd.<\/a>, told SiliconANGLE. \u201cDevelopers rarely upload their apps to these sites, so most of them are put there by third parties, likely without permission.\u201d<\/p>\n

Bischoff added that users should stick to Google Play or another official app store to help ensure they\u2019re getting a legitimate version of the app. Similarly, users should not download an APK that someone sends them as a link or attachment in a message or email.<\/p>\n

Image: ThreatFabric<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n