Operators of Android hacking kit impersonate postal services in US and Europe

With an effective mobile malware kit written, hackers can tweak the code to target different parts of the world.

Two years ago, when researchers at antivirus company Trend Micro reported on a new mobile data-stealing kit known as FakeSpy, they warned there could be more to come from the hackers.

Directing the Android-focused malware at users outside of South Korea and Japan, where it was discovered, would simply be a matter of reconfiguring the code, the researchers said.

That’s exactly what happened.

On Wednesday, another set of researchers, from security company Cybereason, revealed how FakeSpy’s operators have been impersonating various postal services in attacks on users in the U.S., China and Europe in the last several weeks. The hackers have taken aim at thousands of users with the help of phony text messages that, if clicked, install code capable of siphoning off financial data from mobile applications.

The findings show how, with an effective mobile malware kit written, hackers can tweak the code to target different parts of the world and see which attacks are the most profitable. And by sending text messages, they don’t have to break into the Google Play Store to plant their code.

“All the new FakeSpy versions contain the same code DNA with minor changes,” Cybereason researchers wrote in a blog.

The attackers have masqueraded as the U.S. Postal Service, along with couriers from Germany to Britain to Taiwan, according to Cybereason. The text messages tell users they have a package for pickup, but of course there’s nothing of the sort. FakeSpy’s operators appear to be looking for data they can steal and monetize.

Posing as USPS can be an effective way for scammers to get their targets’ attention. Another set of hackers used the tactic to try to send financial data-stealing malware to thousands of users, email security company Proofpoint said in November.

The USPS’s cybercrime unit investigates cases in which criminals impersonate the postal service with text messages or emails, an agency spokesperson said.  The spokesperson declined to comment when asked if the agency was aware of the FakeSpy campaign.

Based on clues in the code and infrastructure, Assaf Dahan, Cybereason’s head of threat research, believes FakeSpy’s operatives are based in China. His team traced one of the malicious domains used in the operation to a Chinese internet service provider. (Researchers at Fortinet, another security vendor, have found similar evidence.)

While it’s unclear how many people clicked on the malicious links, FakeSpy’s operators have been busy. Of the top five Android threats, FakeSpy accounts for 39% of attacks, according to Trend Micro.

“It’s a well-oiled operation that keeps expanding,” Dahan told CyberScoop. “We see new developments and features added to the code all the time, so my guess is that business is good for them.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure