SpyLend Android malware downloaded 100,000 instances from Google Play

An Android malware app known as SpyLend has been downloaded over 100,000 instances from Google Play, the place it masqueraded as a monetary software however grew to become a predatory mortgage app for these in India.

The app falls underneath a bunch of malicious Android functions known as “SpyLoan,” which faux to be authentic monetary instruments or mortgage providers however as an alternative steal information from units to be used in predatory lending.

These apps lure customers with guarantees of fast and simple loans, usually requiring little documentation and providing engaging phrases. Nevertheless, upon set up, they request extreme permissions, permitting the apps to steal private information resembling contacts, name logs, SMS messages, photographs, and gadget location.

This harvested data is then exploited to harass, extort, and blackmail customers, particularly in the event that they fail to fulfill the app’s compensation phrases.

Mortgage scams and extortion

Cybersecurity agency CYFIRMA has found an Android app named “Finance Simplified” that claims to be a monetary administration utility and has amassed 100,000 downloads on Google Play.

Nevertheless, CYFIRMA states that the app shows extra malicious conduct in sure international locations, like India, the place it steals information from person’s units for use in predatory lending. The researchers say additionally they found extra malicious APKs that seem like variants of the identical malware marketing campaign, specifically KreditApple, PokketMe, and StashFur.

Though the app has now been faraway from Google Play, it could proceed to run within the background, amassing delicate data from contaminated units.

A number of person opinions for Finance Simplified on Google Play present that the app gives lending providers that try and extort debtors if they do not pay excessive rates of interest.

“Very very very dangerous app they given low mortgage quantity nd black mail to pay Excessive in any other case photoes edited as a nude nd black mailing,” reads a person assessment for the now-pulled app.

The apps additionally declare to be registered Non-Banking Monetary Corporations (NBFCs), which CYFIRMA says is unfaithful. 

To evade detection on Google Play, Finance Simplified masses a WebView to redirect customers to an exterior web site from the place they obtain a mortgage app APK hosted on an Amazon EC2 server.

“The Finance Simplified app seems to focus on Indian customers particularly by displaying and recommending mortgage functions, loading a WebView that reveals a mortgage service that redirects to an exterior web site the place a separate mortgage APK file is downloaded,” explains CYFIRMA.

The researchers found that the app will solely load the misleading interface if the person location is India, which reveals the marketing campaign has a particular concentrating on.

Delicate information stolen by app

The extra worrying facet of the malware’s exercise is the info assortment, which incorporates delicate private data saved on the person’s gadget.

Here is a abstract of the info the malware steals:

• Contacts, name logs, SMS messages, and gadget particulars.
• Pictures, movies, and paperwork from inside and exterior storage.
• Dwell location monitoring (up to date each 3 seconds), historic location information, and IP tackle.
• Final 20 textual content entries copied to the clipboard.
• Mortgage historical past and banking SMS transaction messages.

Though that information is primarily used for extorting the victims who made the error of making use of for a mortgage, it could even be used for monetary fraud or resold to cybercriminals for revenue.

In case you suspect your gadget was contaminated by any of the talked about apps or related, take away them instantly, reset permissions, change banking account passwords, and carry out a tool scan.

Google’s Play Defend software detects and blocks identified malware and predatory apps, so guarantee it is lively in your gadget.