The National Telecommunication and Information Security Board (NTISB) under the Cabinet Division has released an alert advisory regarding severe vulnerabilities. The alert is for all federal ministries, divisions, and the common man and concerns malicious mobile applications on the Google Play Store.
The advisory noted that a number of the apps recently banned from Google were found to be major risks to privacy and device security. These apps are disguised as innocent utility tools such as File Manager, Phone Manager, Software Update Utility, Smart Manager, and Kakao Security but are developed to gather sensitive user data.
It identifies two key threats: KoSpy spyware and the Anatsa (TeaBot) banking trojan. KoSpy is believed to have links to North Korean APT-37 (ScarCruft) and APT-43 (Kimsuky). It is reported to fetch SMS messages, call logs, audio recordings, screenshots, location information, and files.
At the same time, Anatsa or TeaBot was being spread through apps that pretend to be file managers and document readers. Its victims were users of banking apps; it sought to eavesdrop on their login attempts and steal any financial data they entered. One of the offending apps reportedly had downloads totalling more than 220,000 before being taken down, indicating that it posed a real danger.
NTISB recommends that all users remove any applications listed in the malicious applications section if installed on their device. Moreover, users should install apps only from authentic sources and ensure the authenticity of the apps before installing them. It’s extra important for apps that never-endingly ask for access to everything.
For an extra layer of security, users are recommended to activate the Google Play Protect feature. This feature is built-in malware protection that also scans the installed apps and warns users when any app is detected as high-risk.
This warning is yet another reflection of the complexity of cyber challenges and the need for good digital hygiene in an app-driven world.
