Android SpyNote assaults electrical and water public utility customers in Japan

Authored by Yukihiro Okutomi 

McAfee’s Mobile workforce noticed a smishing marketing campaign in opposition to Japanese Android customers posing as an influence and water infrastructure firm in early June 2023. This marketing campaign ran for a brief time from June 7. The SMS message alerts about fee issues to lure victims to a phishing web site to contaminate the goal units with a remote-controlled SpyNote malware. In the previous, cybercriminals have typically focused monetary establishments. However, on this event, public utilities had been the goal to generate a way of urgency and push victims to behave instantly. Protect your Android and iOS cellular units with McAfee Mobile Security.

Smishing Attack Campaign 

A phishing SMS message impersonating a energy or water provider claims a fee downside, as proven within the screenshot beneath. The URL within the message directs the sufferer to a phishing web site to obtain cellular malware. 

Notice of suspension of energy transmission due to non-payment of prices from an influence firm in Tokyo (Source: Twitter) 

Notice of suspension of water provide due to non-payment of prices from a water firm in Tokyo (Source: Twitter) 

When accessed with a cellular browser, it would begin downloading malware and show a malware set up affirmation dialog. 

The affirmation dialog of Spyware set up through browser (Source: Twitter) 

SpyNote malware 

SpyNote is a recognized household of malware that proliferated after its supply code was leaked in October 2022. Recently, the malware was utilized in a marketing campaign focusing on monetary establishments in January and focusing on Bank of Japan in April 2023.  

The SpyNote malware is remotely managed adware that exploits accessibility providers and system administrator privileges. It steals system info and delicate person info reminiscent of system location, contacts, incoming and outgoing SMS messages, and telephone calls. The malware deceives customers by utilizing legit app icons to look actual. 

Application Icons disguised by malware. 

After launching the malware, the app opens a pretend settings display screen and prompts the person to allow the Accessibility characteristic. When the person clicks the arrow on the backside of the display screen, the system Accessibility service settings display screen is displayed. 

A pretend setting display screen (left), system setting display screen (middle and proper) 

By permitting the Accessibility service, the malware disables battery optimization in order that it might probably run within the background and robotically grants unknown supply set up permission to put in one other malware with out the person’s data. In addition to spying on the sufferer’s system, it additionally steals two-factor authentication on Google Authenticator and Gmail and Facebook info from the contaminated system. 

Although the distribution methodology is totally different, the step of requesting Accessibility service after launching the app is just like the case of the Bank of Japan that occurred in April. 

Scammers sustain with present occasions and try to impersonate well-known firms which have a purpose to achieve out to their clients. The cellular malware assault utilizing SpyNote found this time targets cellular apps for all times infrastructure reminiscent of electrical energy and water. One of the explanations for that is that electrical payments and water payments, which was once issued on paper, are actually managed on the net and cellular app. If you need to study smishing, seek the advice of this text “What Is Smishing? Here’s How to Spot Fake Texts and Keep Your Info Safe”. McAfee Mobile Security detects this menace as Android/SpyNote and alerts cellular customers whether it is current and additional protects them from any knowledge loss. For extra info, go to McAfee Mobile Security. 

Indicators of compromise (IoC) 

C2 Server: 

Malware Samples: 

Download McAfee Mobile Security

McAfee Mobile Security – Protection for Android and iOS

Download McAfee Mobile Security Today