{"id":23662,"date":"2022-12-15T10:43:15","date_gmt":"2022-12-15T10:43:15","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/15\/moneymonger-malware-steals-personal-information-to-blackmail-users\/"},"modified":"2022-12-15T10:43:15","modified_gmt":"2022-12-15T10:43:15","slug":"moneymonger-malware-steals-personal-information-to-blackmail-users","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/15\/moneymonger-malware-steals-personal-information-to-blackmail-users\/","title":{"rendered":"‘MoneyMonger’ malware steals personal information to blackmail users"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Researchers at mobile security company\u00a0Zimperium Inc.\u2019s zLabs<\/a>\u00a0today revealed details of a\u00a0newly discovered Android malware campaign hidden in money lending apps developed with the Flutter software development kit.<\/p>\n

Flutter is a \u00a0multiplatform user interface app development framework from Google LLC<\/a> that\u2019s used to\u00a0create applications that work across multiple platforms, including Android and iOS. The malware campaign, dubbed MoneyMonger, uses personal information stolen from a device to blackmail victims into paying more than the terms that their predatory loans required.<\/p>\n

MoneyMonger is said to take advantage of Flutter\u2019s framework to obfuscate malicious features and complicate the detection of malicious activity by static analysis. The malicious code and activity hide behind the Flutter framework, missed by the analysis capabilities of legacy mobile security products, the researchers say.<\/p>\n

It\u2019s distributed in apps available on third-party app stores and can also be sideloaded onto a victim\u2019s device through phishing messages, compromised websites, social media campaigns and other tactics.<\/p>\n

Active since May 2022, this malware uses multiple layers of social engineering to take advantage of its victims, beginning with a predatory loan scheme promising quick money. As victims install an infected app, they\u2019re told that permissions are needed on the mobile endpoint to ensure they\u2019re in good standing to receive the loan.\u00a0Once the malicious actors gain access to steal private information from the endpoint, MoneyMonger uploads victims\u2019 critical and personal data to its server, including installed apps, GPS locations, SMS, contact information, device information, metadata of images and more.<\/p>\n

The information stolen by MoneyMonger is used to blackmail and threaten victims into paying excessively high interest rates. If the victim fails to pay on time, and in some cases even after the loan is repaid, the malicious actors threaten to reveal information, call people from the contact list and even send photos from the device.<\/p>\n

The loan scam angle aside, the researchers note that MoneyMonger is a risk to individuals and enterprises because of the wide range of data collected from victims\u2019 devices, including potentially sensitive enterprise-related material and proprietary information.<\/p>\n

The actors behind MoneyMonger are constantly developing and updating the app to avoid detection by adding XOR encryption in the string on the Java side, while also adding more information on the Flutter side. The number of victims is unknown given the use of third-party stores and sideloading for distribution, but many of the third-party app stores report more than 100,000 downloads of infected malicious applications.<\/p>\n

\u201cThe extremely novel MoneyMonger malware campaign highlights a growing trend by malicious actors to use blackmail and threats to scam victims out of money,\u201d Richard Melick, director of mobile threat intelligence at Zimperium, said in a statement. \u201cQuick loan programs are often full of predatory models, such as high interest rates and payback schemes, but adding blackmail into the equation increases the level of maliciousness.\u201d<\/p>\n

Image: Pixabay<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n