NTISB says Konfety Group targets Android users with ‘Evil Twin’ malicious Play Store apps

ISLAMABAD: The National Telecommunication & Information Security Board (NTISB) has warned that Konfety Group targets Android users with “Evil Twin” malicious Play Store apps.

The board issued an advisory which stated that Google Play Store identified and thwarted an active malicious campaign targeting Android users globally. Collectively named as Konfety Apps; this campaign used 250+ Decoy Evil Twin android applications.

The malicious activity is allegedly conducted by the Russian Konfety cybercrime group having ulterior motives primarily backed by monetary gains using advertisement fraud.

The advisory further noted that attackers use advertising campaigns to promote modified APK and redirects users to download malicious apps. Konfety malware involves a dropper APK that further loads an obfuscated stager and back door SDK, making it highly evasive hence difficult to detect. Further, the decoy twin apps used by attackers appear harmless while Evil Twin mimics them to commit ad fraud, install payloads, second stage malwares and code injection etc.

The Board recommended that although Google has removed Konfety apps from its Play Store, however, if any of the attached malicious Konfety apps found installed on smart phones, following remedial measures may be opted: a). Immediately uninstall specific Konfety app. b). Perform a factory reset. c). Take a backup of personal media files (excluding device/system apps). d. Restrict unnecessary apps permission and set to while using App only. e). Download and install software only from official app stores like Play Store or the IOS App Store. f. Keep your smart phone, OS and apps updated. g. Regularly check the smart devices/Wi-Fi data usage of apps installed on smart devices. h. Use a reputed anti-virus and internet security software package on your smart devices.

The board issued another advisory which stated that Google has released Chrome browser version 126 with security updates to address 10 vulnerabilities.

Majority of the vulnerabilities are high-severity memory issues potentially leading to Sandbox Escapes and Remote Code Execution. Fixes include flaws in V8’s Implementation, Type Confusion and Use-After-Free bugs in Screen Capture, Media Stream, Audio and Navigation. Google also addressed Race Condition in DevTools and an Out-of-Bound memory access in V8. No exploits in the wild are reported but users are urged to update promptly.

To safeguard against Chrome vulnerabilities, users are advised to ensure that Google Chrome browser is updated to following versions (by navigating to Setting>About Chrome and Re-launching the browser): a. Version 126.0.6478.182 or later on Windows/Linux b. Version 126.0.6478.183 or later on macOS c. Version 126.0.6478.186 or later on Android.

Copyright Business Recorder, 2024