New 'Unremovable' XHelper Malware Has Infected 45,000 Android Devices

'Over the past six months, a new Android malware strain has made a
name for itself after popping up on the radar of several antivirus
companies, and annoying users thanks to a self-reinstall mechanism
that has made it near impossible to remove. Named xHelper, this
malware was first spotted back in March but slowly expanded to infect
more than 32,000 devices by August (per Malwarebytes), eventually
reaching a total of 45,000 infections this month (per Symantec). The
malware is on a clear upward trajectory. Symantec says the xHelper
crew is making on average 131 new victims per day and around 2,400 new
victims per month. Most of these infections have been spotted in
India, the U.S., and Russia.

According to Malwarebytes, the source of these infections is "web
redirects" that send users to web pages hosting Android apps. These
sites instruct users on how to side-load unofficial Android apps from
outside the Play Store. Code hidden in these apps downloads the
xHelper trojan. The good news is that the trojan doesn't carry out
destructive operations. According to both Malwarebytes and Symantec,
for most of its operational lifespan, the trojan has shown intrusive
popup ads and notification spam. The ads and notifications redirect
users to the Play Store, where victims are asked to install other apps
-- a means through which the xHelper gang is making money from
pay-per-install commissions.

What's interesting about xHelper is that it gains access to an Android
device via an initial app and installs itself as a separate
self-standing service. Furthermore, you can't remove the app, as the
trojan reinstalls itself every time, even after users perform a
factory reset.'

-- source: https://tech.slashdot.org/story/19/10/29/2121244

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz