Android malware sneaks into the contacts

A new Android malware is currently causing concern in the security industry: the malware called Crocodilus has recently been developed and can now create fake contacts on infected smartphones in order to build fraud on this.

Basis for fraud stitches

Crocodilus was originally discovered in March by the security company Threat Fabric. Initially, attacks on cryptocurrency users in Turkey focused, and users in the USA, Spain, Brazil, India, Indonesia and Argentina are now also affected. The malware aims primarily on high-quality Android smartphones. The malware can handle Androids integrated protective mechanisms such as Google Play Protect without relying on special access rights such as the operating aids. Crocodilus is distributed via specially adapted “Dropper” apps, which often creep in third-party app stores, fake websites or fraudulent messages.

The new ability to make fake contacts makes the malware particularly perfidious. Users could apparently receive a call from their bank or a family member – but in reality there is an attacker who wants to incorporate personal data or money. Since Android primarily shows the names from their own address book for incoming calls, such deceptions for unsuspecting users are difficult to recognize.

Functional malware

Likewise, Crocodilus already has numerous other functions: the malware enables its operators to control the smartphone remotely, steal data and imitate popular banking apps via so-called overlay attacks in order to get access data. The fake contacts remain stored locally on the device and do not synchronize with the Google account – which also makes the discovery more difficult.

In this regard, security experts also recommend loading apps exclusively from official sources such as the Google Play Store and avoiding suspects or messages. Google Play Protect should also be activated. In view of the rapid further development of crocodilus, experts expect that these malware will continue to make headlines in the future.