McAfee Mobile Threat Report for Q1 Released

As App Store reviews are at least partly based on user ratings, it should come as no surprise to learn that malware is being used to create fake positive reviews for certain apps. The report names a new malware family which is exploiting accessibility on Android devices to create fake accounts then download apps in order to leave fake five star reviews. The malware, called LeifAccess was first observed in May 2019 by McAfee but still appears to be prominent in countries including the USA and Brazil. 

Another section of the Q1 2020 McAfee Mobile Threat Report focuses on ad fraud and fake reviews. The report authors say these originate again with LeifAcess with some apps having as many as 7000 reviews. They are distinguishable by the language used in the review, often employing very simple phrases such as “very simple and useful” alongside the fraudulent rating. The report says the reviews use a combination of around 25 different phrases with LeifAccess then using this to carry out ad fraud by requesting traffic from control servers and then replicating clicks to earn ad revenue. Some of the ads are shown to users and others are hidden, despite taking up space on the victim’s device. 

One of the most prolific trends identified in the report is that of hidden apps, with McAfee saying, “Hidden apps are the most active mobile threat category, generating almost half of all malicious telemetry this year, a 30% increase from 2018. Thousands of apps are actively hiding their presence after installation, making them difficult to locate and remove while annoying victims with invasive ads.”

One of the worst offenders for spyware so far this year is Malbus, a piece of spyware that was embedded in the legitimate South Korean app, Daegu Bus which was designed to give users bus timetable info. The spyware infected the app and phished the user’s device, looking for access to their Google account. Documents were then scanned were certain political and military phrases, with those documents then uploaded to a remote server.