A report published today by HUMAN's Satori threat intelligence team lists 28 applications on Google Play that secretly turned Android devices into proxy servers. Of these 28 applications, 17 were passed off as free VPN software.
Satori analysts report that the offending apps were all using a software development kit (SDK) by LumiApps that contained "
Proxylib," a Golang library to perform the proxying.
HUMAN discovered the first PROXYLIB carrier app in May 2023, a free Android VPN app named "Oko VPN." The researchers later found the same library used by the LumiApps Android app monetization service.
"In late May 2023, Satori researchers observed activity on hacker forums and new VPN applications referencing a monetization SDK,
lumiapps[.]io," explains the
Satori report.
"Upon further investigation, the team determined that this SDK has exactly the same functionality and uses the same server infrastructure as the malicious applications analyzed as part of the investigation into the earlier version of PROXYLIB. "
