A new android malware, ‘Agent Smith’ recently infected over 25 million android mobile devices worldwide. The malware exploits android vulnerabilities to replace legitimate apps with malicious imitation.
The attackers behind ‘Agent Smith’ made use of fraudulent ads for financial gains.
The malware doesn’t steal data from a user. Instead, it hacks apps and forces them to display more ads or takes credit for the ads they already display so that the malware’s operator can profit off the fraudulent views. The malware looks for known apps on a device, such as WhatsApp, Opera Mini, or Flipkart, then replaces portions of their code and prevents them from being updated.
Agent Smith has primarily infected devices in India and other nearby countries. That’s because the main way it’s spread is through a third-party app store called 9Apps that’s popular in that region. After a user downloaded one, the malware would disguise itself as a Google-related app, with a name like “Google Updater,” and then begin the process of replacing code.
In the future, they may even steal sensitive information, including private messages to banking credentials and much more.
How does Agent Smith malware work?
- Attackers lure users into installing ‘Agent Smith’ infected apps containing encrypted malicious files.
- The application decrypts these files and installs the malware on the device.
- The malware then infects existing, legitimate apps in the device.
How to stay safe?
- Always download apps from the official Google Play store, which is better regulated.
- Check all the permissions before installing an app.
- Ensure the device’s operating system and apps are up-to-date.
Have you checked if your device has protection? We recommend proceeding with caution when downloading apps, even from legitimate sources.
Try SEP Mobile
For DataSheet