Android App Trojans Sold on Dark Web for $25-$20,000
Researchers analyzed both clear and dark web hacking forums and discovered that Russian language threat actors are particularly interested in buying and selling these exploits.
The Google Play app store’s security mechanisms are being compromised by cybercriminals who are developing tools to trojanize Android apps and sell them on underground cybercrime marketplaces.
A recent blog post from cybersecurity firm Kaspersky, published on April 10th, 2023, revealed findings from an extensive study of Clear Net and Dark Web forums, highlighting the vulnerabilities in app store security – Most of these forums are Russian speaking.
The blog post stated that despite the vetting process for software uploaded to Google or Apple app stores, no security solution can be considered 100% foolproof. Every scanning mechanism has inherent flaws that can be exploited by threat actors, allowing them to upload malware to Google Play.
Researchers at Kaspersky monitored activities between 2019 and 2023 and found a thriving market on the Dark Web for buyers and sellers exchanging access to app developer accounts, infected Android apps, and botnets, with prices ranging from a few hundred to several thousand dollars.
One of the methods used by attackers to infect apps with malware involves uploading a harmless app to the app store to gain approval and attract a large number of users. Once the app is approved, the attackers release an update to the app that contains malicious code.
Another method is compromising legitimate app developers by hijacking their accounts and infecting existing apps with malware. Weak password policies and lack of two-factor authentication (2FA) make these accounts easy targets for cybercriminals.
Credential leaks are also used to obtain login details to breach accounts and corporate development systems. Kaspersky researchers found that access to a Google Play account can be purchased for as little as $60, while more lucrative accounts, services, or tools come with a higher price tag.
Loaders, which deploy malicious code into Android apps, are particularly sought-after products on the Dark Web marketplace, with prices ranging from $5,000 to…
