{"id":48460,"date":"2024-03-21T15:25:52","date_gmt":"2024-03-21T12:25:52","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=48460"},"modified":"2026-03-28T05:28:41","modified_gmt":"2026-03-28T02:28:41","slug":"kaspersky-warns-of-android-malware-exhibiting-diverse-features","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-warns-of-android-malware-exhibiting-diverse-features\/","title":{"rendered":"Kaspersky warns of Android malware exhibiting diverse features\u00a0"},"content":{"rendered":"\n

21 March 2024<\/p>\n\n\n\n

Three new dangerous Android malware variants have been analyzed by Kaspersky researchers. The Tambir, Dwphon, and Gigabud malicious programs exhibit diverse features, ranging from downloading other programs and credential theft to bypassing two-factor authentication <\/strong>and screen recording, jeopardizing user privacy and security.<\/strong><\/p>\n\n\n\n

In 2023, Kaspersky solutions blocked nearly 33.8 million attacks on mobile devices from malware, adware, and riskware, highlighting a 50% global increase of such attacks from the previous year’s figures. Android malware and riskware activity surged in 2023 after two years of relative calm, returning to early 2021 levels by the end of the year. That said, the number of unique installation packages dropped from 2022, suggesting that malicious actors were more frequently using the same packages to infect different victims: last year Kaspersky detected more than 1.3 million unique malicious installation packages targeting the Android platform and distributed in various ways. Among these were Tambir, Dwphon and Gigabud malicious programs with the diverse features below described.<\/p>\n\n\n\n

Tambir is a spyware application disguised as an IPTV app. It collects sensitive user information, such as SMS messages and keystrokes, after obtaining the appropriate permissions. The malware supports over 30 commands retrieved from its Command and Control server, and has been compared to the GodFather malware, both targeting users mainly in Turkey, though a number of other countries were also affected.<\/p>\n\n\n\n

Gigabud, active since mid-2022, was initially focused on stealing banking credentials from users in Southeast Asia, but later crossed borders into other countries and regions. It has since evolved into a fake loan malware and is capable of screen recording and mimicking tapping by users to bypass two-factor authentication. <\/p>\n\n\n\n

Dwphon, discovered in November 2023, targets cellphones from Chinese OEM manufacturers, primarily targeting the Russian market. The same malware earlier had been found in the firmware of a kids\u2019 smart watch by an Israeli manufacturer distributed mainly in Europe and the Middle East. Dwphon is distributed as a component of a system update application and collects information about the device as well as personal data. It also gathers information regarding installed third-party applications and is capable of downloading, installing and deleting other applications on the device. One of the analyzed samples also included the Triada trojan, one of the most widespread mobile trojans of 2023, which suggests that Dwphon modules are Triada-related.<\/p>\n\n\n\n

\u201cAs Kaspersky\u2019s mobile threats report shows, <\/em>Android malware and riskware activity surged in 2023 after two years of relative calm, returning to levels seen in 2021 by the end of the year. <\/em>Users should exercise caution and should avoid downloading apps from unofficial sources, meticulously reviewing app permissions. Frequently, these apps lack exploitation functionality and depend solely on permissions granted by the user. Furthermore, using anti-malware tools can help preserve the integrity of your Android device,\u201d<\/em>comments Jornt van der Wiel, senior security researcher at Kaspersky\u2019s GReAT.<\/p>\n\n\n\n

Read the full reports on new\u00a0Android malware<\/a>\u00a0and\u00a02023 mobile malware<\/a>\u00a0on Securelist.com.\u202f<\/p>\n\n\n\n

To protect your Android device, follow these recommendations:<\/h2>\n\n\n\n