Users of smart devices continue to face a severe threat from malware assaults as cybercriminals target gullible people to obtain unauthorized access to their data. A shocking study has revealed the actions of the Lemon Group, a cybercrime group that is thought to have infected roughly 9 million Android devices with the "Guerilla" malware.
This malware can potentially compromise the accounts and personal information of Android users, posing a significant risk to their digital security.
According to the report by Trend Micro, a leading Japanese multinational cybersecurity software company, the Guerilla malware is infecting various types of Android devices, including smartphones, watches, TVs, and TV boxes. This sophisticated malware enables scammers to carry out a range of malicious activities, such as loading additional payloads, intercepting one-time passwords from SMS, setting up a reverse proxy from the infected device, and hijacking WhatsApp sessions, among others.
The infiltration of this malware onto Android devices occurs when third-party entities are hired by manufacturers to enhance standard system images. Trend Micro's analysis of Guerilla reveals that a company responsible for producing firmware components for mobile phones also produces similar components for Android Auto, a mobile app used on vehicles' dashboard information and entertainment units. This discovery raises concerns about the possibility of some in-car entertainment systems already being infected with the Guerilla malware.
The tampering with a system library called libandroid_runtime.so allows the injected code to decrypt a DEX file, which is a file format used by the Android operating system for executing bytecode. The decrypted file is loaded into memory and executed by Android Runtime to activate the main plugin used by the attackers, called Sloth, which provides its configuration and establishes communication with a Lemon Group domain.
Given the severity of the threat posed by the Lemon Group and the Guerilla malware, it is crucial for Android device users to be aware of the risks and take necessary steps to safeguard their devices against potential hacking and cybercrime. Here are some essential tips to protect your Android device from Guerilla malware:
By following these precautions and adopting a proactive approach to device security, Android users can significantly reduce their vulnerability to Guerilla malware and similar cyber threats. Stay informed, stay cautious, and take steps to safeguard your personal information and digital well-being.
