Researchers recently uncovered an Android backdoor named 'Xamalicious' that has affected approximately 338,300 devices through malicious apps found on Google Play.
McAfee, a computer security software company, identified 14 infected apps on Google Play, three of which had amassed 100,000 installs each, as per reports from Bleeping Computer.
While Google has removed these apps from its platform, users who installed them since mid-2020 might still have active Xamalicious infections on their phones, requiring manual cleanup and thorough scanning.
Some of the notably popular apps known to carry Xamalicious include Essential Horoscope for Android, 3D Skin Editor for PE Minecraft, Logo Maker Pro, Auto Click Repeater, Count Easy Calorie Calculator, Dots: One Line Connector, and Sound Volume Extender.
Additionally, a separate set of 12 malicious apps housing the Xamalicious threat spread via unapproved third-party app stores, infecting users upon downloading APK (Android package) files, according to the report.
McAfee's telemetry data shows that the bulk of infections were found on devices located in the United States, Germany, Spain, the UK, Australia, Brazil, Mexico, and Argentina.
Xamalicious operates as a.NET-based Android backdoor, concealed within apps built using the open-source Xamarin framework, which complicates code analysis.
Upon installation, it requests Accessibility Service access, granting it elevated privileges to execute operations like navigation gestures, object concealment, and further self-permission grants.
After installation, Xamalicious establishes contact with a command and control (C2) server to retrieve a second-stage DLL payload ('cache.bin') based on specific geographical, network, device configuration, and root status criteria. This sophisticated behavior makes its detection and eradication more challenging.
(With Agency Inputs)
ALSO READ | Google Fixed 8th Zero-Day Bug in Chrome Exploited in Attacks Throughout the Year
ALSO READ | Google Maps 'Driving Mode' on Android Could Cease Operations by 2024
