KasperskyLab has uncovered a new security vulnerability affecting Android devices, claiming it's one of the world's most powerful Android spyware tools.
Named 'Skygofree', the threat apparently enables attackers to hack into Android smartphones and tablets and extract WhatsApp messages from victims' devices.
"The malware can also monitor popular apps such as Facebook Messenger, Skype, Viber, and WhatsApp," Kaspersky'sAnna Markovskaya revealed in a blog post. "In the latter case, the developers again showed savvy; the Trojan reads WhatsApp messages through Accessibility Services."
The tool is not a new one, either. While it was only recently discovered, the Russian security giant says it dates back as far as 2014.
Warning of the dangers of the spyware tool,Markovskaya explained that Skygofree can not only take audio from a smartphone's microphone when it's in a certain location, but also force infected devices to surreptitiously connect to a Wi-Fi network and gather even more personal data. This, the firm said, lets it collect and analyse a victim's web traffic, meaning someone somewhere will know exactly what sites they looked at and what logins, passwords, and card numbers they entered.
"The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen, so it waits for the targeted application to be launched and then parses all nodes to find text messages,"Markovskaya said.
"Essentially, Accessibility Services provide[s] a nice route into other applications as they have permission to do so, via an application programming interface (API)."
In a seperate SecureList blog, Kaspersky security experts concluded thatSkygofree is "one of the most powerful spyware tools that we have ever seen for this platform". Nevertheless, the teamsaid it has only logged a few infections of the tool, and those have all been in Italy. While that doesn't sound very scary unless you live in Italy, the firm said that this doesn't mean that users in other countries can let their guard down, as malware distributors can change their target audience at any moment.
Kaspersky'sMarkovskaya issued three ways users can protect themselves against this advanced Trojan, just like any other infection.
The first is by only installing apps only from official stores and disabling installation of apps from third-party sources, which you can do in your smartphone settings.
The second is by not downloading an app if you're in any doubt whatsoever.
"Pay attention to misspelled app names, small numbers of downloads, or dubious requests for permissions any of these things should raise flags,"Markovskaya also warned.
Finally, she advised that users should install a reliable security solution in order to protect your device from most malicious apps and files, suspicious websites, and dangerous links.
