Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This evil Android malware has one devious USP — it doesn't even need to be opened to start stealing all your photos and files

Android logo.

Security researchers have spotted new Android malware that doesn’t even need user interaction to launch. However, to become fully operational and run the processes it was designed to do - it still needs the victim’s approval.

Cybersecurity researchers from McAfee said they observed a new version of XLoader, a known Android malware variant that was used in the past to steal sensitive user information from victims in the US, UK, Germany, France, Japan, South Korea, and Taiwan. This new loader is distributed in the same manner as its predecessors - via an SMS message containing a shortened URL, leading to a website hosting the malicious .APK file. 

However, the key difference comes after installation - the victim doesn’t need to run the new variant - it automatically launches, and stealthily at that. Google was already tipped off and is working on a fix: "While the app is installed, their malicious activity starts automatically," McAfee said. "We have already reported this technique to Google and they are already working on the implementation of mitigations to prevent this type of auto-execution in a future Android version."

Asking for permissions

But simply running the app will not suffice, as it still needs vital permissions to start stealing data. To trick the victims into granting them, the malware was given the name Chrome, but via Unicode strings - so the app’s font will look slightly off, which should be enough of a red flag. If that doesn’t ring any alarms, the permissions the app seeks should: it asks for the ability to send and access SMS content, and to be able to always run in the background. 

As the pop-up messages asking for these permissions are available in English, Korean, French, Japanese, German, and Hindi, McAfee’s researchers believe these are also target countries. 

Among other things, XLoader can steal people’s photos, send SMS messages, extract existing SMS messages to a third-party server, export contact lists, grab device identifiers, and more.

Via BleepingComputer

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.