New Xamalicious Android Malware Hits Over 330,000 Devices

McAfee's Mobile Research Team has uncovered a sophisticated Android backdoor, dubbed “Xamalicious”, that has compromised an estimated 338,300 devices worldwide. The malicious software, developed using Xamarin — an open-source framework for building Android and iOS apps with.NET and C# –- has been actively infecting devices through malicious apps available on Google Play and various third-party marketplaces.

McAfee's investigation uncovered that Xamalicious has a two-stage approach as a backdoor malware. Initially, it lures users into granting accessibility privileges via social engineering. Once these permissions are secured, Xamalicious contacts its command-and-control server to assess whether to download a second-stage payload.

This payload, injected as an assembly DLL at the runtime level, empowers the malware to control the infected device fully. Without user consent, it enables various fraudulent actions, such as ad clicking and unauthorized app installations.

What makes Xamalicious dangerous is its ability to self-update the main APK, giving it the potential to evolve into different types of malware, including spyware or banking trojans. This adaptability, coupled with functions that exploit Android's powerful accessibility services, underscores the high risk posed by this backdoor.

A notable aspect of this malware is its link to the advertising fraud app Cash Magnet. This connection suggests that the threat actors behind Xamalicious are financially motivated, using ad fraud as a primary method of generating illicit revenue. Cash Magnet operates by automatically clicking ads and installing apps, rewarding users with points supposedly redeemable for retail gift cards.

McAfee researchers also stated that the malware authors used the Xamarin framework to help disguise their malicious code effectively, while employing various obfuscation techniques and custom encryption to evade detection and analysis.

The impact of Xamalicious has been widespread, with the most significant number of affected users located in the American continent, predominantly in the USA, Brazil, and Argentina. Europe has not been spared, with notable infection rates in the UK, Spain, and Germany.

Among the applications distributed on Google Play that harbored this insidious malware, some of the most downloaded include "Essential Horoscope for Android," "3D Skin Editor for PE Minecraft," and "Logo Maker Pro," each amassing around 100,000 installs. Other infected apps with lower but still concerning install numbers are "Auto Click Repeater," "Count Easy Calorie Calculator," "Sound Volume Extender," and several others.

As cybersecurity experts continue to unravel the complexities of Xamalicious, it is a stark reminder of the evolving landscape of Android malware. While Google Play Protect offers some level of protection by warning users of identified malicious apps, the prevalence of such threats in third-party marketplaces remains a challenge. Users are advised to exercise caution, particularly with apps requiring access to accessibility services without a clear and reasonable need.