{"id":3683,"date":"2021-11-11T22:54:39","date_gmt":"2021-11-11T17:24:39","guid":{"rendered":"https:\/\/xiarch.com\/blog\/?p=3683"},"modified":"2021-11-11T22:54:42","modified_gmt":"2021-11-11T17:24:42","slug":"android-spyware-operations-targeting-south-korean-users-phonespy","status":"publish","type":"post","link":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/","title":{"rendered":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019"},"content":{"rendered":"\n

A currently going spyware named \u201cPhoneSpy\u201d targets South Korean users through a maximum range of lifestyle applications that burrow in the system and silently exfiltrate information.<\/p><\/p>\n\n\n\n

The operation set up a powerful Android Malware which is cable of hijacking sensitive information from the users and taking over the device\u2019s microphone and camera. Security investigators who discovered the operation reported their search to the US and South Korean authorities, but the host that supports the C2 server is yet to be taken down.<\/p><\/p>\n\n\n\n

Covered in \u201cInoffensive\u201d Application<\/strong><\/h2>\n\n\n\n

The \u2018PhoneSpy\u2019 spyware arrives as unrecognizable as a Yoga companion application, the Kakao Talk messaging application, an image gallery browser, and a photo editing tool, and so on. Security a researcher also identifies 23 stoned application that appears as harmless or inoffensive applications, but in the background, the applications execute all the time, silently spying on the users.<\/p><\/p>\n\n\n\n

To do that, the applications ask the victim to allow various permissions upon installation, which is the only stage where the circumspect users would notice signs of trouble.  <\/p><\/p>\n\n\n\n

\"PhoneSpy-Android-Spyware-Operations-targeting-South-Korean-Users-image1\"<\/figure><\/div>\n\n\n\n

The spyware that is hiding inside the disguise applications can do the following on a negotiated device:<\/p><\/p>\n\n\n\n

  • Fetch the complete list of the installed applications<\/li>
  • Uninstall any application on the device<\/li>
  • Install apps by downloading APKs from links provided by C2<\/li>
  • Steal credentials using phishing URLs sent by C2<\/li>
  • Steal images (from both internal and SD card memory)<\/li>
  • Monitoring the GPS location<\/li>
  • Steal SMS messages<\/li>
  • Steal phone contacts<\/li>
  • Steal call logs<\/li>
  • Record audio in real-time<\/li>
  • Record video in real-time using front & rear cameras<\/li>
  • Access camera to take photos using front & rear cameras<\/li>
  • Send SMS to attacker-controlled phone number with attacker-controlled text<\/li>
  • Exfiltrate device information (IMEI, Brand, device name, Android version)<\/li>
  • Conceal its presence by hiding the icon from the device’s drawer\/menu<\/li><\/ul>\n\n\n\n

    The spectrum of the hijacked information is expanded enough to support almost any malicious activity, from spying on employees and spouses to conducting corporate cyber espionage and threatening people.<\/p><\/p>\n\n\n\n

    Apart from the spyware functionality, some of the applications also currently try to hijack people\u2019s credentials by displaying fraudulent login pages for various sites. Phishing templates utilized in the PhoneSpy operation mimick Facebook, Instagram, Kakao, and Google account login portals.<\/p><\/p>\n\n\n\n

    \"PhoneSpy-Android-Spyware-Operations-targeting-South-Korean-Users-image2\"<\/figure><\/div>\n\n\n\n

    Allocating Laced Application<\/strong><\/h2>\n\n\n\n

    The initial distribution channel for the laced application is unknown, and the attacker did not upload the application to the Google Play Store. It could be allocated through the websites, ambiguous party APK stores, social media forums, or even web hard and torrents.<\/p><\/p>\n\n\n\n

    The probable distribution method may be through the SMS sent by the negotiated device to its contact list since the malware is capable. Using SMS texts increases the chances of the recipients tapping on the link that results in downloading the laced applications as it comes from a person they know and trust.<\/p><\/p>\n\n\n\n

    \"PhoneSpy-Android-Spyware-Operations-targeting-South-Korean-Users-image3\"<\/figure><\/div>\n\n\n\n

    If you think you might have downloaded a risky app carrying spyware, delete it immediately and then run an AV scanner to clean your device of any remnants. In cases where privacy and security are imperative, perform a factory reset on the device.  <\/p><\/p>\n","protected":false},"excerpt":{"rendered":"

    A currently going spyware named \u201cPhoneSpy\u201d targets South Korean users through a maximum range of lifestyle applications that burrow in the system and silently exfiltrate information. The operation set up a powerful Android Malware which is cable of hijacking sensitive information from the users and taking over the device\u2019s microphone and camera. Security investigators who […]<\/p>\n","protected":false},"author":2,"featured_media":3688,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"yoast_head":"\nAndroid Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited\" \/>\n<meta property=\"og:description\" content=\"A currently going spyware named \u201cPhoneSpy\u201d targets South Korean users through a maximum range of lifestyle applications that burrow in the system and silently exfiltrate information. The operation set up a powerful Android Malware which is cable of hijacking sensitive information from the users and taking over the device\u2019s microphone and camera. Security investigators who […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\" \/>\n<meta property=\"og:site_name\" content=\"Xiarch Solutions Private Limited\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/xiarch\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-11T17:24:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-11-11T17:24:42+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/11\/PhoneSpy-Android-Spyware-Operations-targeting-South-Korean-Users-featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Xiarch Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@xiarch\" \/>\n<meta name=\"twitter:site\" content=\"@xiarch\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Xiarch Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\"},\"author\":{\"name\":\"Xiarch Security\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\"},\"headline\":\"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019\",\"datePublished\":\"2021-11-11T17:24:39+00:00\",\"dateModified\":\"2021-11-11T17:24:42+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\"},\"wordCount\":520,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"articleSection\":[\"Vulnerabilities\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\",\"url\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\",\"name\":\"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited\",\"isPartOf\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#website\"},\"datePublished\":\"2021-11-11T17:24:39+00:00\",\"dateModified\":\"2021-11-11T17:24:42+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/xiarch.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/xiarch.com\/blog\/#website\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"name\":\"Xiarch Solutions Private Limited\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/xiarch.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/xiarch.com\/blog\/#organization\",\"name\":\"Xiarch\",\"url\":\"https:\/\/xiarch.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"contentUrl\":\"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png\",\"width\":300,\"height\":300,\"caption\":\"Xiarch\"},\"image\":{\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/xiarch\/\",\"https:\/\/twitter.com\/xiarch\",\"https:\/\/www.linkedin.com\/company\/xiarch\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c\",\"name\":\"Xiarch Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g\",\"caption\":\"Xiarch Security\"},\"sameAs\":[\"https:\/\/xiarch.com\/blog\/\"],\"url\":\"https:\/\/xiarch.com\/blog\/author\/vector\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/","og_locale":"en_US","og_type":"article","og_title":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited","og_description":"A currently going spyware named \u201cPhoneSpy\u201d targets South Korean users through a maximum range of lifestyle applications that burrow in the system and silently exfiltrate information. The operation set up a powerful Android Malware which is cable of hijacking sensitive information from the users and taking over the device\u2019s microphone and camera. Security investigators who […]","og_url":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/","og_site_name":"Xiarch Solutions Private Limited","article_publisher":"https:\/\/www.facebook.com\/xiarch\/","article_published_time":"2021-11-11T17:24:39+00:00","article_modified_time":"2021-11-11T17:24:42+00:00","og_image":[{"width":1000,"height":525,"url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/11\/PhoneSpy-Android-Spyware-Operations-targeting-South-Korean-Users-featured-image.jpg","type":"image\/jpeg"}],"author":"Xiarch Security","twitter_card":"summary_large_image","twitter_creator":"@xiarch","twitter_site":"@xiarch","twitter_misc":{"Written by":"Xiarch Security","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#article","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/"},"author":{"name":"Xiarch Security","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c"},"headline":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019","datePublished":"2021-11-11T17:24:39+00:00","dateModified":"2021-11-11T17:24:42+00:00","mainEntityOfPage":{"@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/"},"wordCount":520,"commentCount":0,"publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"articleSection":["Vulnerabilities"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/","url":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/","name":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019 - Xiarch Solutions Private Limited","isPartOf":{"@id":"https:\/\/xiarch.com\/blog\/#website"},"datePublished":"2021-11-11T17:24:39+00:00","dateModified":"2021-11-11T17:24:42+00:00","breadcrumb":{"@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/xiarch.com\/blog\/android-spyware-operations-targeting-south-korean-users-phonespy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/xiarch.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Android Spyware Operations targeting South Korean Users \u2018PhoneSpy\u2019"}]},{"@type":"WebSite","@id":"https:\/\/xiarch.com\/blog\/#website","url":"https:\/\/xiarch.com\/blog\/","name":"Xiarch Solutions Private Limited","description":"","publisher":{"@id":"https:\/\/xiarch.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/xiarch.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/xiarch.com\/blog\/#organization","name":"Xiarch","url":"https:\/\/xiarch.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","contentUrl":"https:\/\/xiarch.com\/blog\/wp-content\/uploads\/2021\/06\/xi-logo-002.png","width":300,"height":300,"caption":"Xiarch"},"image":{"@id":"https:\/\/xiarch.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/xiarch\/","https:\/\/twitter.com\/xiarch","https:\/\/www.linkedin.com\/company\/xiarch"]},{"@type":"Person","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/655d814a04eacce56942270cfdc5c59c","name":"Xiarch Security","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/xiarch.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d33699ed91b76568586dc1ae278ea568?s=96&d=mm&r=g","caption":"Xiarch Security"},"sameAs":["https:\/\/xiarch.com\/blog\/"],"url":"https:\/\/xiarch.com\/blog\/author\/vector\/"}]}},"_links":{"self":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3683"}],"collection":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/comments?post=3683"}],"version-history":[{"count":1,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3683\/revisions"}],"predecessor-version":[{"id":3689,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/posts\/3683\/revisions\/3689"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media\/3688"}],"wp:attachment":[{"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/media?parent=3683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/categories?post=3683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/xiarch.com\/blog\/wp-json\/wp\/v2\/tags?post=3683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}