Android.Cynos.7.origin trojan infected +9 million Android devices

Researchers spotted dozens of games on Huawei’s AppGallery catalog containing the Android.Cynos.7.origin trojan.

Researchers from Dr. Web AV discovered 190 games on Huawei’s AppGallery catalog (i.e. simulators, platformers, arcades, strategies, and shooters) that were containing the Android.Cynos.7.origin trojan. They estimated that the malicious apps were installed on at least 9.300.00 Android devices. Experts state that some of these games target Russian-speaking users with Russian localization, titles, and descriptions, while others were designed to target Chinese or international audiences.

The Android.Cynos.7.origin is a modified version of the Cynos program module which can be integrated into Android apps to monetize them. The module is known since at least 2014, but experts pointed out that some versions implement aggressive features such as the capability to send premium SMS, intercept incoming SMS, download and launch extra modules, and download and install other apps.

The strain of malware analyzed by the researchers was designed to collect the information about users and their devices and displaying ads.

Dr. Web AV shared its findings with Huawei and helped the Chinese giant in removing the malicious apps from the AppGallery store.

Upon executing the tainted apps, they ask users for permission to make and manage phone calls. The malware can allow threat actors to steal the following data:

• User mobile phone number
• Device location based on GPS coordinates or the mobile network and Wi-Fi access point data (when the application has permission to access location)
• Various mobile network parameters, such as the network code and mobile country code; also, GSM cell ID and international GSM location area code (when the application has permission to access location)
• Various technical specs of the device
• Various parameters from the trojanized app’s metadata

“At first glance, a mobile phone number leak may seem like an insignificant problem. Yet in reality, it can seriously harm users, especially given the fact that children are the games’ main target audience.” states the report.

“Even if the mobile phone number is registered to an adult, downloading a child’s game may highly likely indicate that the child is the one who actually using the mobile phone. It is very doubtful that parents would want the above data about the phone to be transferred not only to unknown foreign servers, but to anyone else in general.”

The games with the largest number of installations are listed below:

• 快点躲起来 (Hurry up and hide) – 2,000,000 installs
• Cat game room – 427,000 installs
• Drive school simulator – 142,000 installs

Below are the Indicators of compromise shared by the experts.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini
International Editor-in-Chief
Cyber Defense Magazine