Security News SonicSpy Authors Spin Out Over 1,000 Spyware Apps (some of which appeared on Google Play)

[LASER_oneXM]

A new variant of SonicSpy was recently discovered on Google Play, one of over a thousand apps that have been tied to the malware family since February, according to researchers from Lookout published in a blog post today.

The SonicSpy variant most recently found on the Google Play app store is called Soniac and is marketed as a messaging app. Although Soniac will perform some messaging functions, through the use of a customized version of Telegram, its author's intent is to hijack a user's Android phone. Some of Soniac's capabilities include silently recording audio, taking photos, making outbound calls, and sending text messages to phone numbers that the attacker specifies, according to Lookout.

Lookout researchers believe the actors behind SonicSpy may be prolific because they are using an automated process to churn out the variants, the company says.

 

[Deletedmessiah]

More of malware/spyware entering Playstore. Personally I install only very popular apps with high no. of installations so I should be safe. Maybe?

 

[LASER_oneXM]

few minutes ago i found some additional infos about this malware:

source(bleepingcomputer.com): Spyware Apps Found on Google Play Store

Researchers believe the same developer created both spyware families. They base their theory on the fact that both apps used dynamic DNS services that ran on the non-standard port of 2222, and both were decompiled, injected with the malicious code, and recompiled with the same desktop utility, possibly part of a custom automated build system.

SonicSpy supports a vast array of malicious actions
On infected devices, SonicSpy supports 73 different malicious actions in the form of instructions it receives from a remote server. Below is a summary of the most intrusive ones:

➥ silently record audio
➥ Silently take photos with available cameras
➥ Make outbound calls
➥ Send SMS messages
➥ Retrieve call logs
➥ Get data on WiFi access points
Users get infected by installing the app and granting it the permissions it needs to perform all its abusive actions. The apps are very hard to spot because they include a fully-working chat application, giving victims no reason to suspect they were infected.