Android Backdoor GhostCtrl Can Steal Everything from a Phone, Spy on Users

  • This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.

MalwareTips Bot

MWT Robot
Staff member
Content Creator
Apr 21, 2016
1,032
#1
Android seems to have become the preferred target of virus writers across the world, with new forms of malware capable of infecting more devices detected every day.

This time, security company Trend Micro warns of a new Android backdoor called GhostCtrl and which is a variant of the more famous OmniRAT that was discovered in late 2015 and affected a wider array of platforms, including Windows, Linux, and Mac.

GhostCtrl is specifically trying to infect Android devices and it spreads as stand-alone APKs with names like App, MMS, whatsapp, or Pokemon GO. The malware has been discovered in three different versions, with the most advanced giving hackers full control over a device and the rights to access and transfer any data stored locally.

“The malicious APK, after dynamically clicked by a wrapper APK, will ask the user to install it. Avoiding it is very tricky: even if the user cancels the “ask for install page” prompt, the message will still pop up immediately. The malicious APK doesn’t have an icon. Once installed, a wrapper APK will launch a service that would let the main, malicious APK run in the background,” the company explains.

Read more: Android Backdoor GhostCtrl Can Steal Everything from a Phone, Spy on Users