File Manager App Infected Thousands of Devices with SharkBot Malware
Introduction
In a concerning development, a notorious Android banking fraud malware named SharkBot has once again infiltrated the official Google Play Store, this time disguised as file manager apps. Despite the marketplace's strict restrictions, the malware managed to bypass security measures and infected thousands of devices. This blog post explores the impact of SharkBot, its distribution tactics, and the steps users can take to protect themselves from such threats. Let's dive in!
SharkBot: The Menace Returns
Initially discovered by Cleafy in late 2021, SharkBot is a persistent mobile threat that has targeted both the Google Play Store and various third-party app stores. This time, the malware took the form of seemingly harmless file manager apps, making it difficult for unsuspecting users to identify the threat. According to Romanian cybersecurity company Bitdefender, the majority of affected users were located in the United Kingdom and Italy.
The Tactics: Silent Invasion and Financial Fraud
SharkBot's primary objective is to initiate unauthorized money transfers from compromised devices. It accomplishes this through a technique known as "Automatic Transfer System" (ATS). When a user triggers a transaction using a banking app, SharkBot intercepts it and replaces the payee account with an account controlled by the threat actors. This surreptitious process occurs in the background, leaving users unaware of the fraudulent activity taking place. Furthermore, SharkBot employs fake login overlays to steal banking credentials from unsuspecting victims.
Disguise and Infiltration: The Rogue File Manager Apps
The malicious file manager apps employed by SharkBot were cunningly designed to appear legitimate while serving their nefarious purposes. These apps often masquerade as antivirus software or cleaners, allowing them to slip past Google's security checks and gain entry to the Play Store. Once installed on a device, these seemingly innocent apps become droppers, fetching and installing the actual malware payload. The following apps were identified as carriers of SharkBot:
- X-File Manager (com.victorsoftice.llc) - Over 10,000 downloads
- FileVoyager (com.potsepko9.FileManagerApp) - Over 5,000 downloads
- LiteCleaner M (com.ltdevelopergroups.litecleaner.m) - Over 1,000 downloads
Fortunately, these apps have been removed from the Play Store. However, it's worth noting that LiteCleaner M is still available for download from a third-party app store called Apksos. Another SharkBot-infected app, named "Phone AID, Cleaner, Booster" (com.sidalistudio.developer.app), was also discovered on Apksos.
Google's Challenge: Permission Abuse and Countermeasures
The threat actors behind SharkBot cleverly exploited the limited permissions allowed for certain app categories in Google's Developer Program Policy. By abusing the permission to install external packages (REQUEST_INSTALL_PACKAGES), the malware authors could remotely download and install their malicious payloads. Notably, the X-File Manager app specifically targeted users in Italy, accumulating over 10,000 downloads before its removal.
Protecting Against SharkBot and Similar Threats
If you have unwittingly installed any of the aforementioned apps, it is crucial to take immediate action to safeguard your finances and personal information. Follow these steps:
- Delete the infected apps from your device.
- Change your bank account passwords promptly.
- Enable Play Protect in the Play Store to enhance your device's security.
- Exercise caution when downloading apps and carefully review their ratings and reviews.
Conclusion: Stay Vigilant, Stay Secure!
The resurgence of the SharkBot malware disguised as file manager apps serves as a stark reminder of the evolving threats faced by Android users. By staying vigilant, promptly removing suspicious apps, and adopting best security practices, users can mitigate the risks posed by such malware. Let's ensure our digital lives remain secure and protected!