In an attempt to disseminate Triout Android malware, attackers corrupted the widely used Android app in Google Play.
The new (corrupted) version of the app which delivers the malware was discovered by security researchers at Bitdefender. Reportedly, “com.psiphon3”, the app package which is known for giving uncensored access to the content on the internet was exploited by cybercriminals as they reconfigured it with spyware framework.
The threat actors decided to distribute the corrupted version of the app via third-party app stores instead of going conventional by delivering it via the Google Play store and to generate revenue, they tied up the app with Google Ads, Mopub Ads, InMobi Ads, and various other adware components.
While hiding its presence into the device, Triout Android Malware is programmed to collect phone calls, record videos, take pictures, access text messages, and GPS. It transfers the gathered information to the hackers’ command and control server.
As per the researchers at Bitdefender, the original and the tainted app shares the same UI which means the criminals only inserted the Triout spyware component while tampering the app and they tampered v91 of the app which currently is running on v241.
Referencing from the findings of researchers, “The original legitimate application is advertised as a privacy tool that enables access to the open internet when bundled with the Triout spyware framework it serves the exact opposite purpose.”
“While the Triout Android spyware framework itself does not seem to have undergone changes in terms of code or capabilities, the fact that new samples are emerging and that threat actors are using extremely popular apps to bundled the malware,”
