Blog Layout

Malware Hidden Inside Games Found In Microsoft Store

sccomputerguys • Mar 11, 2022

Security experts tell people all the time to never to download apps from anywhere other than official sources like the Microsoft Store, the Google Play Store, and the Apple App Store.

It's good advice but unfortunately, even those sources aren't perfect when it comes to keeping malicious apps that have been poisoned with malware off of their virtual shelves.

Recently, the cyber-intelligence firm named Check Point discovered poisoned clones of a number of popular games like Temple Run and Subway Surfer.  These poisoned clones have been responsible for compromising more than five thousand machines located primarily in Sweden, Israel, Spain, and Bermuda.

The code lurking in these poisoned copies of popular games is called Electron Bot and it is fairly mild in terms of what it does. It seeks to earn profits by taking control of machines and commandeering their social media accounts including Facebook, Google, YouTube and Sound Cloud.

If the owner of the infected system happens not to have accounts on any of those services, that's fine too.  Electron Bot is more than capable of setting up brand new accounts and then commenting and "liking" content on those platforms which is engaging in click fraud.

This Electron Bot is not new.  It was first spotted in the wild in the waning days of 2018 masquerading as an app called "Album by Google Photos" on the Google Play store.

Since then, the malicious code has undergone several revisions and each time the authors have further refined the code and added new capabilities to it.

According to the Check Point researchers, the main goals of the group behind the malware seem to be:

  • SEO poisoning - Create malware-dropping sites that rank high on Google Search results.
  • Ad clicking - Connect to remote sites in the background and click on non-viewable advertisements.
  • Social media account promotion - Direct traffic to specific content on social media platforms.
  • Online product promotion - Increase store rating by clicking on its advertisements.

As malware goes that's hardly the worst thing but it's still not something you want on your system. So be warned and be aware.

By sccomputerguys 22 Jul, 2022
Do you own one or more of the following products made by Cisco? The RV110W Wireless-N VPN Firewall The RV130 VPN Router The RV130W Wireless-N Multifunction VPN Router The RV215W Wireless-N VPN ...
By sccomputerguys 21 Jul, 2022
Do you use Microsoft Teams?  If so, you'll be thrilled to know that the Redmond Giant is continuing to pour resources into improving the software with a specific focus on audio and ...
By sccomputerguys 20 Jul, 2022
Corporate branding can be worth its weight in gold and certain images are absolutely iconic.  The Golden Arches, the Nike "swoosh," and Apple's Apple all come to mind. Logo images give companies ...
By sccomputerguys 19 Jul, 2022
Remember the Heartbleed scare we had a couple years back?  It was a nasty side-channel attack that was somewhat exotic and difficult to pull off, and it was absolutely devastating and sent ...
By sccomputerguys 18 Jul, 2022
Microsoft Exchange servers are once more in the crosshairs of hackers around the world.  Most recently, hacking groups have been specifically targeting them to deploy BlackCat ransomware. As is common among ransomware ...
By sccomputerguys 16 Jul, 2022
If you grew up in the days before the internet, it's absolutely staggering to think of all the ways that mobile technology has changed our lives (and mostly for the better). Remember ...
By sccomputerguys 15 Jul, 2022
It may seem as though Internet Explorer is the browser that will not die, but according to Microsoft, it is now a step closer to breathing its last virtual breath. Microsoft has ...
By sccomputerguys 14 Jul, 2022
If you're involved with IT Security at any level and if your network includes Linux servers, keep a watchful eye out for the new Panchan botnet. It first appeared in the wilds ...
By sccomputerguys 13 Jul, 2022
These days, companies spend significant sums of money to protect themselves from cyber criminals.  The threat matrix is vast, and attacks can come from almost any quarter. That is why many companies ...
By sccomputerguys 12 Jul, 2022
Do you receive healthcare of any kind from Kaiser Permanente?  If so, be aware that they recently published a data breach notification indicating that an unidentified attacker accessed an email account that ...
More Posts
Share by: