A new Trojan that targets Android devices while pretending to be a game of noughts and crosses has been uncovered by security researchers.
According to Anton Kivva, antivirus analyst at Kaspersky Lab, the Gomal Trojan sports all of the usual spyware functionality, including the ability to record sounds, process calls and steal SMS messages.
The Tic-Tac-Toe malware also uses tools that provide access to various Linux services by attacking the Android operating system and can also read the device's process memory, which, according to Kivva, can jeopardise many communication applications.
Gomal also steals data from logcat the logging service built into Android that is used for application debugging. "Developers very often have their applications outputting critically important data to Logcat even after the apps have been released. This enables the Trojan to steal even more confidential data from other programs," said the security researcher.
The malware is capable of stealing emails from Good for Enterprise, a secure email client for corporate use, the researcher added. Data theft in this situation could lead to serious issues for the company where the device owner works.
"In order to attack Good for Enterprise, the Trojan uses the console to get the ID of the relevant process (ps command) and reads virtual file /proc//maps. The file contains information about memory blocks allocated to the application," said Kivva in a blog post.
The techniques used by Gomal were originally implemented in Windows Trojans, but have now progressed to Android malware.
"What's more alarming is that this technique can adapt to steal data from other applications as well as Good for Enterprise it is likely that a range of mobile malware designed to attack popular email clients, messengers and other programs will appear in the near future," he said.
-
CronRat Magecart malware uses 31st February date to remain undetectedNews The malware allows for server-side payment skimming that bypasses browser security
-
Mekotio trojan continues to spread despite its operators’ arrestsNews Hackers have used it in 100 more attacks since arrests
-
“Trojan Source” hides flaws in source code from humansNews Organizations urged to take action to combat the new threat that could result in SolarWinds-style attacks
-
What is Emotet?In-depth A deep dive into one of the most infamous and prolific strains of malware
-
Fake AnyDesk Google ads deliver malwareNews Malware pushed through Google search results
-
Hackers use open source Microsoft dev platform to deliver trojansNews Microsoft's Build Engine is being used to deploy Remcos password-stealing malware
-
Android users told to be on high alert after Cerberus banking Trojan leaks to the dark webNews The source code for the authenticator-breaking malware is available for free on underground forums
-
Qbot malware surges into the top-ten most common business threats
News An evolved form of the banking Trojan was distributed by number one-ranking Emotet in a campaign that hit 5% of businesses globally
