InfoSecBulletin Cybersecurity for mankind
ESET researchers found a spying campaign targeting Android users. The campaign uses fake messaging apps that include XploitSPY malware. The campaign, called eXotic Visit, has been active from November 2021 to the end of 2023.
Malicious Android apps were distributed through targeted campaigns using dedicated websites and the Google Play store. These apps had a low number of installs on Google Play and have since been removed.
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely
WSJ reports
T-Mobile hacked in massive breach of telecom networks
Palo Alto Networks Confirms critical RCE zero-day actively exploited
CISA, FBI Warns
Hacker compromised multiple teleco network at US
The eXotic Visit campaign seems to focus on specific Android users in Pakistan and India. It is not known which group is behind this campaign, but we are monitoring the threat actors and calling them Virtual Invaders.
Apps with XploitSPY can get contact lists, files, GPS location, and file names from specific directories related to the camera, downloads, Telegram, and WhatsApp. Certain filenames can be further extracted from these directories by a command from the control server. The chat function in XploitSPY is unique and believed to be developed by the Virtual Invaders group.
The malware uses a native library commonly used in Android app development to hide important information, such as C&C server addresses. This makes it difficult for security tools to analyze the app.
The apps mentioned below were removed from Google Play after ESET, as a Google App Defense Alliance partner, discovered that they contained harmful code. The low number of installations suggests that they were used in a targeted manner. The “eXotic Visit” apps were identified as part of this campaign, and the Technical analysis section examines the XploitSPY code present in these apps. Click here to read out the full report.
