December 5, 2023 at 04:33PM
ESET researchers found that malicious “SpyLoan” apps have been downloaded over 12 million times from Google Play in 2023, with higher unknown totals from other sources. These apps pose as legitimate loan services, scamming users with high-interest loans while stealing personal data to blackmail them. The operation spans multiple countries. ESET advises caution with financial app downloads.
Meeting Takeaways:
1. Over 12 million downloads of malicious loan applications called SpyLoan have been reported on Google Play, with additional downloads occurring from third-party app stores and websites.
2. SpyLoan apps misrepresent themselves as legitimate personal loan services while actually enrolling users into high-interest payments and collecting sensitive personal and financial information for blackmail purposes.
3. Victims report that the actual annual cost of loans is much higher than advertised, and repayment periods are shorter than agreed upon.
4. ESET researchers have identified aggressive marketing strategies for SpyLoan, including SMS and social media advertising. All versions of the app share the same code and therefore exhibit the same harmful behavior.
5. The operators of these malicious apps are based in various countries, including Mexico, Indonesia, Thailand, Vietnam, India, Pakistan, Colombia, Peru, and the Philippines.
6. SpyLoan apps exfiltrate user data such as call logs, calendar events, device info, installed apps, Wi-Fi SSIDs, and file data, with personal information like SMS, contacts, and location data also compromised.
7. ESET warns that the real intent behind the permissions requested by these apps is to facilitate spying, harassment, and blackmailing of users and their contacts.
8. To safeguard against such threats, ESET advises users to exercise caution when downloading financial apps by verifying their authenticity before use.