Android users have once again, for the umpteenth time, been exposed to malware. Security company has detected a new form of CopyCat which has hit no less than 14 million devices across the world.
Aimed primarily at Asian users, but also infecting devices in other markets like the United States and Canada, CopyCat has been specifically going after outdated Android devices. The reason being the outdated devices are easier to be exploited with their older versions of the operating system.
Google has stated that it has banned the CopyCat in Play Protect, but it looks like the malware was not downloaded from the Google Play Store anyway, but rather from infected apps published in third-party stores.
Over 280,000 Android devices in United States and another 381,000 in Canada were infected, early statistics show.
CopyCat lands on Android phones as part of apps which are distributed in third-party stores and once it compromises a device, it collects system information and downloads additional malware that can eventually help root the device. This means the hackers will get root access to the device, bypassing security systems and having full control over the system.
CopyCat monitors apps running and being installed on the infected device and it replaces ads with its own, while showing banners as well, once in a while. This helps malware writers generate money, and Check Point says they made approximately $1.5 million with no less than 100 million ads and 4.9 million fake apps that were installed on compromised devices.
There’s a good chance the malware comes from China, though this isn’t confirmed just yet. The security company found some connections with Chinese ad network MobiSummer, and it says that attackers have even whitelisted Chinese users, meaning they haven’t been hit by the virus most likely as the hackers wanted to avoid any investigation from the local police.
