Legit Android apps Poisoned by sticky 'Zombinder' Malware

[upnorth]

Content source

https://www.theregister.com/2022/12/09/zombinder_android_windows_malware/

Threat researchers have discovered an obfuscation platform that attaches malware to legitimate Android applications to lure users to install the malicious payload and make it difficult for security tools to detect.

Analysts with cybersecurity vendor ThreatFabric found the platform, named "Zombinder," on the darknet while investigating a campaign that targeted both Android and Windows users with different types of malware. Zombinder came to light while the researchers were analyzing a campaign involving the Ermac Android banking trojan. That effort yielded evidence of another campaign using multiple trojans aimed at both Android and Windows systems. Along with Ermac, it was distributing desktop malware including Erbium, Aurora stealer, and Laplas clipper.

"While investigating Ermac's activity, our researchers spotted an interesting campaign masquerading as applications for Wi-Fi authorization," the researchers write. "It was distributed through a fake one-page website containing only two buttons."

The researchers discovered that the cybercriminals were using a third-party service – Zombinder – that provided the "glue" to bind the malware dropper capabilities to the legitimate app. Once downloaded, the app – now tied to the malware – operated as expected until an update message appeared.

"At this point, if accepted by the victim, the seemingly legitimate application will install this update, which is nothing else than Ermac," they write. "Such process is achieved by 'glueing' [an] obfuscated malicious payload to a legitimate app with minor updates made to original source code to include installation and loading of the malicious payload." The APK binding service has been available since March and is being frequently used by different attacks, the researchers write. It's provided by what they say is "an actor well-known in the threat landscape."

An ad for Zombinder on a darknet forum explains "binding is needed to install your bot via making a potential victim feel more safe and trust the legitimate software in which your android bot will be embedded."

Legit Android apps poisoned by sticky ‘Zombinder’ malware

Sure, go ahead and load APKs instead of using an app store. You won't enjoy the results

www.theregister.com