Over 400 Million Android Devices Infected With SpinOk Spyware
In a massive cyber-security incident, over 400 million Android devices have been infected with a new malware strain known as SpinOk, distributed as a software development kit (SDK) for advertisers. The spyware was discovered in 101 popular Android applications by security researchers at Dr. Web. The affected apps have been downloaded more than 400 million times combined, indicating the wide-reaching impact of this cyber-attack.
The SpinOk spyware module operates covertly, performing malicious activities while appearing as a legitimate SDK. It was likely added to these applications by developers under the guise of legitimacy. It uses minigames to provide daily rewards to users, maintaining user engagement while carrying out its nefarious actions.
The malware is capable of stealing private data stored on infected devices and sending it to a remote server controlled by the hackers responsible for the campaign. It also checks sensor data from the device, including the gyroscope and magnetometer, to determine if it’s running on an actual phone.
A list of the most downloaded affected apps has been released. These include popular apps like ‘Noizz: video editor with music’, ‘Zapya – File Transfer, Share’, ‘vFly: video editor&video maker’, and ‘MVBit – MV video status maker’, among others. Experts recommend users to delete these apps immediately for their own safety, though the spyware has been removed in the latest versions of many of these apps.
The trojanized SDK connects to a remote server to download a list of websites used to display minigames within the infected apps. While these minigames operate as expected, SpinOk conducts a range of malicious activities in the background. These include listing files in directories, searching for particular files, and uploading files from the infected device. The malware can also copy and replace content from the user’s clipboard, a functionality that could be used to steal passwords and credit card data or hijack cryptocurrency payments.
The incident raises questions about the security of apps even within the Google Play Store. Despite Google’s security checks, harmful apps sometimes manage to slip through. Users are advised to exercise caution when downloading new apps, checking ratings and reviews, and being mindful of unnecessary permissions requested by apps. For additional protection, installing antivirus apps or using Google Play Protect, which comes pre-installed for free on all Android phones, is recommended.
Investigations by Google and other parties into how this trojanized SDK ended up inside so many popular Android apps are expected to yield more information about SpinOk in the future.
