Back then, the spyware, built on the foundations of AhMyth, circumvented Google’s app-vetting process twice, as a malicious app providing radio streaming. However, this is not the first time that AhMyth-based Android malware has been available on Google Play we previously published our research on such a trojanized app in 2019. The malicious code that was added to the clean version of iRecorder is based on the open-source AhMyth Android RAT (remote access trojan) and has been customized into what we named AhRat.īesides this one case, we have not detected AhRat anywhere else in the wild.
#Todo today app android update#
It is rare for a developer to upload a legitimate app, wait almost a year, and then update it with malicious code.
The application’s specific malicious behavior, which involves extracting microphone recordings and stealing files with specific extensions, potentially indicates its involvement in an espionage campaign.What is quite uncommon is that the application received an update containing malicious code quite a few months after its launch. Initially, the iRecorder app did not have any harmful features.As a Google App Defense Alliance partner, we detected a trojanized app available on the Google Play Store we named the AhMyth-based malware it contained AhRat.
0 kommentar(er)
