Malware News Ever-Evolving Trojan Roots Devices and Infects Android System Process

[Exterminator]

The trojan known as Android.Xiny continues to evolve and in its most recent iteration, Xiny has gained the ability to infect a core Android system process that facilitates and hides its malicious behavior, making the uninstallation process many times more difficult.

The first versions of Android.Xiny appeared in March 2015, and just like all malware in its beginnings, these versions were trivial to detect and with minimal features.

But Xiny evolved, and in January 2016, security researchers were reporting about new stealth features that allowed the trojan to pass through Google's security scans and make its way inside the Play Store, disguised inside 60 apps.

At that particular point in time, the trojan relied on tricking users into giving those apps root privileges in order to function. Once users granted Xiny admin rights, the trojan would show ads, install other apps, or steal data from the device and hide it inside PNG images via a technique called steganography.

Xiny doesn't ask users for admin rights anymore. It takes them by force
Dr.Web, a Russian security firm, says recent versions of this trojan don't bother asking users for admin privileges but come with an exploit package that gets these rights by rooting the device.

The security vendor says these versions haven't been spotted in live & distributed apps but appear to be a test version on which the crooks are still working.

But rooting the device is not the most dangerous function. Researchers also say Android.Xiny will install rogue modules inside Android system directories, which it will use to infect Zygote, one of Android's core processes.

Android.Xiny hijacks Android's Zygote process
With control over Zygote, Xiny then injects other packages in other applications. For example, researchers say they've found functionality in Xiny's code to infect the Google Play app, which it uses to install other apps on the system, without the user's consent.

Further, Xiny can also inject the processes of IM chat application, and intercept or send messages. The trojan also targets banking or other financial apps and uses its root privileges to show a fake login page and collect user credentials.

Android.Xiny is not the first Android trojan that infected Android's Zygote process. In February, Dr.Web also discovered Android.Loki, who behaves in a similar way, by rooting the device and infecting Zygote to install unwanted apps on the user's device, for the crook's monetary gain.