Chrome of danger: Experts warn Android users of new malware threat!

In the digital age, staying informed about cybersecurity threats is as crucial as locking your front door at night.

For the millions of Android users out there, a new warning bell is ringing, and it's one you can't afford to ignore.

The convenience of automatic updates and the trust we place in familiar names like Google Chrome can sometimes lead us to a false sense of security. However, as recent events have shown, even the most vigilant among us can be caught off guard.


The latest threat came disguised as a Google Chrome update, a clever ruse that has already ensnared unsuspecting users.

This isn't the first time Android devotees have been targeted; a similar scam was identified just a few weeks prior.

The malicious software, known as Brokewell malware, is a chameleon. It constantly evolves, with new commands added almost daily, making it a formidable foe.


compressed-shutterstock_2160486223.jpeg
Experts warned against the new Android malware called 'Brokewell' which masquerades as a Google Chrome update and has extensive device takeover capabilities. Credits: Shutterstock


Threat Fabric reported that the new Brokewell malware includes ‘an extensive set of Device Takeover capabilities’.

‘This approach seems innocent (with a carefully crafted page promoting an update for a newer version of the software) and natural (as it occurs during normal browser use) to unsuspecting victims.’

The malware is described as a ‘previously unseen malware family with a wide range of capabilities’, including accessing banking apps and performing complete or partial device takeovers.

It is still in development, with new commands being added on a ‘daily’ basis.


Brokewell's modus operandi is deceptively simple: it presents itself as an innocuous update page for Chrome, luring users into a trap.

Once installed, it boasts a terrifying array of capabilities.

While infiltrating banking apps is concerning, the malware's capability to capture all data on your device is even more alarming: ‘All actions are logged and sent to the command-and-control server, effectively stealing any confidential data displayed or entered on the compromised device.’

This implies that any app or service on a user's phone could be vulnerable to compromise, not just the ones initially targeted.

It's a digital pickpocket, adept at stealing login details and session cookies, which can bypass multi-factor authentication by masquerading as a trusted user.

The malware's dropper, the initial app that downloads the main malware, is particularly insidious.

It sidesteps Android's accessibility protections, designed to prevent such attacks, leaving your device vulnerable to a full-scale invasion of privacy.


Cybersecurity experts at Threat Fabric have raised the alarm, cautioning that the distribution of this new dropper ‘will have a significant impact on the threat landscape—more actors will gain the capability to bypass Android restrictions,’ which ‘highlights the ongoing demand for such capabilities among cybercriminals. These actors require this functionality to commit fraud directly on victims' devices, creating a significant challenge for fraud detection tools that heavily rely on device identification or device fingerprinting’.

Threat Fabric anticipates broader dissemination of the new dropper and malware through typical ‘underground channels’, posing a risk to all Android users who may install apps or updates from sources outside the official store.


For those with Google Play Protect enabled, there's a layer of defence against known versions of this malware. However, the best protection is vigilance and adherence to best practices:

Stick to official app stores: Avoid using third-party app stores and refrain from altering your device's security settings to allow app installations from unknown sources. Additionally, make sure to enable Google Play Protect on your device.

Check the developer in the app’s description: Before downloading an app, check the developer's details in the app description to ensure credibility, and review user feedback to verify legitimacy.

Do not grant permissions to an app that it should not need: Torch and star-gazing apps do not require access to your contacts and phone. Avoid granting accessibility permissions that enable device control unless necessary.

Never ever click links in emails or messages that directly download apps or updates: Instead, use app stores for installations and updates.

Do not install apps that link to established apps like Chrome unless you know for a fact they’re legitimate: Verify their legitimacy through reviews and online sources.


This report highlights the dangers of malware targeting Android devices, urging users to be cautious about the apps they download.

In light of this, it's essential to stay informed about the latest threats and take proactive steps to protect your digital safety.
Key Takeaways
  • A new malware threat labelled 'Brokewell' is targeting Android users, posing as a Google Chrome update and bearing extensive device takeover capabilities.
  • Users are tricked by a crafted page promoting a fake update, which seems innocent and occurs during normal browser use, leading unsuspecting victims to fall for the deception.
  • The malware's abilities are particularly concerning as they include capturing login details through overlay screens, stealing session cookies, and having the potential to compromise all apps and services on a device.
  • Android users were advised to stick to official app stores, carefully check app developers and reviews, be cautious with app permissions, and never click on links for direct app downloads or updates outside of official app stores.
Have you or someone you know encountered similar cybersecurity threats? How do you ensure your digital safety? Join the conversation in the comments below.
 
Sponsored
I always do play protect and under settings do a scan. I am trying to get rid of apps not add more.
 
  • Like
Reactions: Davmes
The better defence is not use Google Chrome.The best defence is to chuck that mobile phone in the deep blue sea.

When scammers get hold of AI to plague the world..........what, they already have?
 
Welcome to the digital age... I am now getting more emails warning me about scams, viruses and new hacking methods than from friends and other welcome sources .... the 'systems' that have brought us such 'favourites' as bullying, and resulting suicides, theft of your savings, sexual harassment, data stealing etc. etc. and it's only going to get worse.... cheer up everyone as some of my younger associates tell me that I have to move forward with the times.... if this is progress I for one can do without it...
 
After having a rather bad experience with Chrome i now always delete that as soon as i get a device it's bloatware after all and totally safe to delete as it is NOT part of the Manufacturers software essential to run the device.
I would NOT use Chrome if it was the only browser standing - i'd run my current one in compat mode if i had too!! CHROME SUCKS!!!!!
It never was safe, never was usable, never was what they make it out to be and it is as bad as Bing which is totally crap as well.
If you don't have it then you won't get the update.

I also use trusted apps like Playstore to get updates as they verify them for nasties before allowing them on their platforms.
 
  • Like
Reactions: Ingot

Join the conversation

News, deals, games, and bargains for Aussies over 60. From everyday expenses like groceries and eating out, to electronics, fashion and travel, the club is all about helping you make your money go further.

Seniors Discount Club

The SDC searches for the best deals, discounts, and bargains for Aussies over 60. From everyday expenses like groceries and eating out, to electronics, fashion and travel, the club is all about helping you make your money go further.
  1. New members
  2. Jokes & fun
  3. Photography
  4. Nostalgia / Yesterday's Australia
  5. Food and Lifestyle
  6. Money Saving Hacks
  7. Offtopic / Everything else

Latest Articles

  • We believe that retirement should be a time to relax and enjoy life, not worry about money. That's why we're here to help our members make the most of their retirement years. If you're over 60 and looking for ways to save money, connect with others, and have a laugh, we’d love to have you aboard.
  • Advertise with us

User Menu

Enjoyed Reading our Story?

  • Share this forum to your loved ones.
Change Weather Postcode×
Change Petrol Postcode×