BEWARE: Your Google Chrome may be at risk due to a 'very dangerous' update
- Replies 18
Google Chrome, the world's most widely used web browser, is currently under threat from a fraudulent update that's been dubbed 'very dangerous'.
Disguised as a legitimate Chrome update, malicious software has been found stealing private data, messages, and photos from unsuspecting users.
This alarming news comes from a recent report by cybersecurity firm McAfee, which has urged Android users to avoid clicking any message links that claim to install Chrome updates on their devices.
The report reveals that the notorious MoqHao malware is lurking within these downloads, employing a new and highly dangerous technique.
Once the fraudulent Chrome update is installed, it begins its malicious activity automatically.
The malware requests extensive user permissions, including access to SMS, photos, contacts, and even the phone itself.
It operates in the background, connecting with its command and control server, managing data to and from the device, and causing increasing damage.
A threat actor that typically operates in Asia called the Roaming Mantis group is believed to be behind this MoqHao (XLoader) campaign.
However, this specific campaign also appears to target users in Europe and the US, as one of the languages programmed into the campaign is English.
The fraudulent update cleverly uses Unicode characters to trick users into thinking it’s a legitimate Chrome update.
'This technique makes some characters appear bold, but users visually recognise it as “Chrome”,' McAfee explained.
'This may affect app name-based detection techniques that compare app name (Chrome) and package name (com.android.chrome).'
This is the third major Android malware alert of the year so far, following VajraSpy, SpyLoan, and Xamalicious.
There has also been a broader warning about copycat apps, which mirrors what we’re seeing here.
As for this specific malware, McAfee warned that they 'expect this new variant to be highly impactful because it infects devices simply by being installed without execution'.
Jake Moore from ESET, a software company specialising in cybersecurity, added: 'Copycat apps are simple to produce.'
'Downloading and installing a malicious app on your phone can lead to a number of disasters, including theft of personal data, compromise of banking information, poor device performance, intrusive adware and even spyware monitoring your conversations and messages.'
In response to the McAfee report, a Google spokesperson stated that 'Android has multi-layered protections that help keep users safe.'
'Android users are currently protected against this by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behaviour, even when those apps come from sources outside of Play.'
Google has also confirmed its collaboration with McAfee to address the new malware threat. McAfee is understood to be one of Google’s App Defense Alliance partners.
Members, always be cautious when downloading apps or updates, and remember to regularly check your device's security settings.
What are your thoughts on this latest news, dear members? Let us know in the comments below.
Disguised as a legitimate Chrome update, malicious software has been found stealing private data, messages, and photos from unsuspecting users.
This alarming news comes from a recent report by cybersecurity firm McAfee, which has urged Android users to avoid clicking any message links that claim to install Chrome updates on their devices.
The report reveals that the notorious MoqHao malware is lurking within these downloads, employing a new and highly dangerous technique.
Once the fraudulent Chrome update is installed, it begins its malicious activity automatically.
A new malware has been discovered by McAfee. Image source: Freepik.
The malware requests extensive user permissions, including access to SMS, photos, contacts, and even the phone itself.
It operates in the background, connecting with its command and control server, managing data to and from the device, and causing increasing damage.
A threat actor that typically operates in Asia called the Roaming Mantis group is believed to be behind this MoqHao (XLoader) campaign.
However, this specific campaign also appears to target users in Europe and the US, as one of the languages programmed into the campaign is English.
The fraudulent update cleverly uses Unicode characters to trick users into thinking it’s a legitimate Chrome update.
'This technique makes some characters appear bold, but users visually recognise it as “Chrome”,' McAfee explained.
'This may affect app name-based detection techniques that compare app name (Chrome) and package name (com.android.chrome).'
This is the third major Android malware alert of the year so far, following VajraSpy, SpyLoan, and Xamalicious.
There has also been a broader warning about copycat apps, which mirrors what we’re seeing here.
As for this specific malware, McAfee warned that they 'expect this new variant to be highly impactful because it infects devices simply by being installed without execution'.
Jake Moore from ESET, a software company specialising in cybersecurity, added: 'Copycat apps are simple to produce.'
'Downloading and installing a malicious app on your phone can lead to a number of disasters, including theft of personal data, compromise of banking information, poor device performance, intrusive adware and even spyware monitoring your conversations and messages.'
In response to the McAfee report, a Google spokesperson stated that 'Android has multi-layered protections that help keep users safe.'
'Android users are currently protected against this by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behaviour, even when those apps come from sources outside of Play.'
Google has also confirmed its collaboration with McAfee to address the new malware threat. McAfee is understood to be one of Google’s App Defense Alliance partners.
What are your thoughts on this latest news, dear members? Let us know in the comments below.
.png){kind=icon}
