Android malware campaign 'targets 1 million Google accounts'

Check Point says Android malware campaign can steal tokens from Google accounts

More than one million Google accounts have been compromised by a new authentication-theiving malware campaign called Gooligan, according to security company Check Point.

In a blog post, Check Point said the malware steals authentication tokens from infected Android devices, which can later be used to access Google Play, Gmail, Google Photos, Google Docs, G Suite, Google Drive and other data stored with Google.

The Gooligan malware campaign appears to affect 74% of in-market devices, particularly those running on Android 4 (JellyBean, KitKat) and 5 (Lollipop).

Around 57% of these devices are in Asia and 9% are in Europe. Android users can check whether their account is compromised here.

Check Point suggested that, if an account has been breached, users should carry out a clean installation ("flashing") of the operating system on the affected mobile device. As this is a complicated process, however, the company said users may want to power off the device and ask their mobile service provider or a certified technician to 're-flash' the device.

Check Point also recommended changing all Google account passwords once the "flashing" process is complete.

The security company is working closely with Google to investigate the source of this campaign.

Adrian Ludwig, Google's director of Android security, said: "We're appreciative of both Check Point's research and their partnership as we've worked together to understand these issues. As part of our ongoing efforts to protect users from the Ghost Push family of malware, we've taken numerous steps to protect our users and improve the security of the Android ecosystem overall."

To counteract the malware campaign, Google is reportedly notifying affected accounts, revoking affected tokens and deploying SafetyNet improvements.

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

How to unroot Android
Google Android

How to unroot Android

28 May 2021
Qualcomm modem flaw puts millions of Android users at risk
Google Android

Qualcomm modem flaw puts millions of Android users at risk

6 May 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021

Most Popular

Q&A: Enabling transformation
Sponsored

Q&A: Enabling transformation

10 Jun 2021
OnePlus 9 Pro review: An instant cult classic
Hardware

OnePlus 9 Pro review: An instant cult classic

7 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021