Fake cybersecurity app. Use Hugging Face.

Fake cybersecurity app. Use AI app deposit "Hugging Face," release malware down Android.

In this cybersecurity era, users of IT devices such as computers or smartphones are often interested in downloading cybersecurity applications for protection, and that is also a vulnerability for hackers to impersonate.

According to a report by the website Phone World, it has mentioned the detection of a malware release campaign of remote control of the victim's machine or the RAT (Remote Access Trojan) by secretly claiming to be a cybersecurity application for the Android operating system called TrustBastion that claims to have a lot of cyber detection capabilities - fake ads, short messages (SMS or Short Message Service), scams, phishing scam attempts, and various types of malware. But in reality, this fake app instead acts as a dropper to download malware (payload) files of RAT malware. Such came down installed on the machine.

The source does not say where the start of the scam to download and install this fake application started, but it is expected that it may come from a fake advertisement that tricked you into downloading an application for a 3rd Party Android smartphone. After downloading and installing it, the fake app will contact a server on the URL called trustbastion [.] com. After reaching the server, the server will redirect to the digital library (Repo or Repository) called "Hugging Face," which Repo is usually a trusted service. Yes, and often used to deposit artificial intelligence or AI projects, but hackers can use it as a source of malware.

The malware retrieves the payload files of the RAT malware from Hugging Face via the Content Delivery Network. The CDN system is also a Hugging Face system. In this way, the malware can evade detection. In addition, a research team from Bitdefender, an anti-malware developer company, found that the server's Polymorphism system is used to modify subvariants of malware every 15 minutes to effectively evade detection from the victim's system. Up.

The RAT malware is not listed in any way, but the research team has described that the malware is focused on stealing data such as passwords from financial services such as Alipay and WeChat. Using the Overlayt Attack technique to trick victims into entering passwords on fake screens. In addition, it is also used to steal screen unlock codes. The research team also revealed that the malware will take control of the victim's machine through the Disabled User Support or Accessibility Mode to use the ability to steal data as follows:

Screen stacking system, as mentioned above.

Screen capture (Screenshot)

Simulation of scrolling screen and pressing (Tap) screen

Uninstallment Protection

Monitor the victim's behavior.

And to create even greater consistency, malware also loads content like real apps from the control server (C2 or Command and Control) to deceive victims.

In order to combat this campaign, the research team collaborated with Hugging Face to successfully delete malware payload files from the system. It also advised mobile phone users to use them safely. The instructions are as follows:

Avoid downloading applications from 3rd Party download sources.

Beware of security warnings from unusual-looking applications.

Review requests for permissions and be careful with every approval.

Install updates of the application only through the official channel.

# Trending # Lemon 8 Howtoo # lemon 8 diary # huggingface # freedomhack