New Android threat sends your photos, texts, contacts, hardware data and more to a foreign server

New Android threat sends your photos, texts, contacts, hardware data and more to a foreign server،

According to Computer beeping, a new version of XLoader malware (aka MoqHao) is making the rounds. Previously, this malware was spotted in the United States, United Kingdom, Germany, France, Japan, South Korea, and Taiwan. The malware is delivered via SMS text messages with a shortened URL link and XLoader can launch immediately after installation. This allows the malware to run in the background undetected while personal data is stolen.

Fake permission requests appear to come from Google Chrome: New Android threat sends your photos, texts, contacts, hardware data and more to a foreign server

Fake permission requests are made to appear as if they are coming from Google Chrome

McAfee says: “During application installation, their malicious activity starts automatically. We have already reported this technique to Google and they are already working on implementing mitigations to prevent this type of automatic execution in a future version of Android.”

Another Fake Permission Request: New Android Threat Sends Your Photos, Texts, Contacts, Hardware Data and More to a Foreign Server

Another false authorization request

Malicious apps send permission requests pretending to come from Google Chrome, asking for permission to send and view SMS (text) messages and asking for permission to let “Chrome” run in the background. And the final blow is the permission to make “Chrome” your default SMS application. The malware, once it has obtained all these permissions, is used to send photos, text messages, contact lists and information about the hardware you are using (including your phone's unique IMEI number) to the control server. Yes, it's very scary.

McAfee claims that because minimal interaction is required from the victim, the new XLoader malware is even more dangerous than its predecessor. There is some good news. A McAfee update from a few weeks ago indicates that Android devices with Google Play Services are protected against attacks from this type of malware by Google Play Protect, which is enabled by default.

There are, however, a few things to remember here. Never click on a shortened URL found in a message. And never sideload an app.