Huawei App Gallery Malvertised

Millions of Android devices have been infected by a new class of malware that disguises itself as dozens of arcade, shooter, and strategy games on Huawei’s App Gallery marketplace to steal device information and victims’ mobile phone numbers.

Researchers classified the trojan as “Android.Cynos.7. origin,” because the malware is a modified version of the Cynos malware. Of the total 190 rogue games identified, some were designed to target Russian-speaking users, while others were aimed at Chinese or international audiences.

After the installation, completed the apps prompted the victims for permission to make and manage phone calls, using the access to harvest their phone numbers along with other device information such as geolocation, mobile network parameters, and system metadata.

• User mobile phone number
• Device location based on GPS coordinates or the mobile network and Wi-Fi access point data
• Various mobile network parameters, such as the network code and mobile country code; also, GSM cell ID and international GSM location area code
• Various technical specs of the device
• Various parameters from the trepanised app’s metadata

At first glance, a mobile phone number leak may seem like an insignificant problem. Yet, it can seriously harm users, especially given the fact that children are the games’ main target audience.

Even if the mobile phone number is registered to an adult, downloading a child’s game may highly likely indicate that the child is the one who using the mobile phone. It is very doubtful that parents would want the above data about the phone to be transferred not only to unknown foreign servers, but to anyone else in general. While the malware-laced apps have since been purged from the app stores, users who have installed the apps on their devices will have to manually remove them to prevent further exploitation.

Indicators of Compromise