While not isolated to Android, especially if you include iPhones that are jailbroken, this is generally an issue for Android because users may choose to download apps from alternatives to Google. How to protect yourself being a victim of this phishing app: Don’t install an app outside playstore. Don’t allow your android devices to install anonymous apps. Using Anomor website. Anomor.com is the website that helps hack the FB account it is not automatically done. The technique is also known as AP Phishing, WiFi Phishing, Hots potter, or Honeypot AP. These kind of attacks make use of phony access points with faked login pages to capture user’s WiFi credentials, credit card numbers, launch man-in-the-middle attacks, or infect wireless hosts.

Free download on Chrome Web Store Free (the Premium version also includes these benefits). Conducts privacy audit for all apps Identifies the access privileges of every app on your Android device so you know exactly what information you're sharing. Scans for phishing URLs when you're using the Chrome browser and alerts you when any are detected to ensure you have a safer experience while surfing the web. Identifies the access privileges of every app on your Android device so you know exactly what information you're sharing. Download Malwarebytes for Android for a free 30-day trial.

Mobile

We identified an undocumented Android spyware we have named ActionSpy while tracking Earth Empura, also known as POISON CARP/Evil Eye. The campaign is reportedly targeting Uyghurs by compromising their Android and iOS mobile devices.

While tracking Earth Empura, also known as POISON CARP/Evil Eye, we identified an undocumented Android spyware we have named ActionSpy (detected by Trend Micro as AndroidOS_ActionSpy.HRX). During the first quarter of 2020, we observed Earth Empusa’s activity targeting users in Tibet and Turkey before they extended their scope to include Taiwan. The campaign is reportedly targeting victims related to Uyghurs by compromising their Android and iOS mobile devices. This group is known to use watering hole attacks, but we recently observed them using phishing attacks to deliver their malware.

The malware that infects the mobile devices is found to be associated with a sequence of iOS exploit chain attacks in the wild since 2016. In April 2020, we noticed a phishing page disguised as a download page of an Android video application that is popular in Tibet. The phishing page, which appears to have been copied from a third-party web store, may have been created by Earth Empusa. This is based on the fact that one of the malicious scripts injected on the page was hosted on a domain belonging to the group. Upon checking the Android application downloaded from the page, we found ActionSpy.

Figure 1. The Earth Empusa attack chain

ActionSpy, which may have been around since 2017, is an Android spyware that allows the attacker to collect information from the compromised devices. It also has a module designed for spying on instant messages by abusing Android Accessibility and collecting chat logs from four different instant messaging applications.

Phishing attacks delivering ActionSpy

Earth Empusa’s use of phishing pages is similar to our recent report on Operation Poisoned News, which also used web news pages as a lure to exploit mobile devices. Earth Empusa also used social engineering lures to trick its targets into visiting the phishing pages. We found some news web pages, which appear to have been copied from Uyghur-related news sites, hosted on their server in March 2020. All pages were injected with a script to load the cross-site scripting framework BeEF. We suspect the attacker used the framework to deliver their malicious script when they found a targeted victim browsing the said sites. However, our investigation did not yield any script when we attempted to access said phishing pages. How these pages were distributed in the wild is also unclear.

Figure 2. A news page copied from the World Uyghur Congress website used for loading the BeEF framework

Upon continued investigation in late April 2020, we found another phishing page that appears to be copied from a third-party web store and injected with two scripts to load ScanBox and BeEF frameworks. This phishing page invites users to download a video app that is known to Tibetan Android users. We believe the page was created by Earth Empusa because the BeEF framework was running on a domain that reportedly belongs to the group. The download link was modified to an archive file that contains an Android application. Analysis then revealed that the application is an undocumented Android spyware we named ActionSpy.

Figures 3 and 4. Fake Android application download page (In original language and translated into English)

Figure 5. The injection of ScanBox (above) and BeEF (below) on the phishing page shows overlap to Earth Empusa’s domain

Breaking Down ActionSpy

This malware impersonates a legitimate Uyghur video app called Ekran. The malicious app has the same appearance and features as the original app. It is able to achieve this with VirtualApp. In addition, it’s also protected by Bangcle to evade static analysis and detection.

Avast free. download full version. Download full versions of Avast software. Get full version Avast licenses completely free. Step 1 - Go to the recommendation program. Crack, torrents, and keygens often contain viruses or malware. That means the antivirus might not work reliably.

Figure 6. ActionSpy’s icon (left) and appearance (right)

Figure 7. ActionSpy is protected by Bangcle

Facebook Phishing App

A legitimate Ekran APK file is embedded in the ActionSpy assets directory, and installed in virtual environment after VirtualApp is ready when ActionSpy is launched the first time.

Figure 8 and 9. Install real “Ekran” (above) and launch it (below)

ActionSpy’s configuration, including its C&C server address, is encrypted by DES. The decryption key is generated in native code. This makes static analysis difficult for ActionSpy.

Every 30 seconds, ActionSpy will collect basic device information like IMEI, phone number, manufacturer, battery status, etc., which it sends to the C&C server as a heartbeat request. The server may return some commands that will be performed on the compromised device. All the communication traffic between C&C and ActionSpy is encrypted by RSA and transferred via HTTP.

Figure 10. Collected device information

ActionSpy supports the following modules:

Module Name	Description
location	Get device location latitude and longitude
geo	Get geographic area like province, city, district, street address
contacts	Get contacts info
calling	Get call logs
sms	Get SMS messages
nettrace	Get browser bookmarks
software	Get installed APP info
process	Get running processes info
wifi connect	Make device connect to a specific Wi-Fi hotspot
wifi disconnect	Make the device disconnect to Wi-Fi
wifi list	Get all available Wi-Fi hotspots info
dir	Collect specific types of file list on SDCard, like txt, jpg, mp4, doc, xls..
file	Upload files from device to C&C server
voice	Record the environment
camera	Take photos with camera
screen	Take screenshot
wechat	Get the structure of WeChat directory
wxfile	Get files that received or sent from WeChat
wxrecord	Get chat logs of WeChat, QQ, WhatsApp, and Viber

Abuse of Accessibility

Normally, a third-party app can’t access files belonging to others on Android. This makes it difficult for ActionSp

Phishing App Download For Android