Palo Alto Networks

Android

Hidden Devil in the Development Life Cycle: Google Play Apps Infected with Windows Executable Files

Last year, Unit 42 reported a number of Google play apps infected with malicious IFrames in this report. Recently, we found similar cases on Google Play. However, this time, there are 145 Google Play apps infected by malicious Microsoft Windows executable files instead of malicious IFrames. We have reported our findings to Google Security Team and all infected apps have been removed from Google Play....

Unit 42

Jul 30, 2018

By Yue Chen, Wenjun Hu, Xiao Zhang and Zhi Xu

Palo Alto Networks

Products and Services

Partners

News of the Week

News of the Week: June 16, 2018

Did you miss any of this week’s Palo Alto Networks action? Don’t worry – we’ve rounded up our top news and views right here:

Jun 16, 2018

By Justin Hall

Endpoint, Products and Services, Secure the Enterprise

Introducing Traps for Android

In March, we announced Traps 5.0 and the Traps management service, a cloud-based service designed to simplify administration and management of your endpoint security. One of the benefits of the Traps management service is the ability to inn...

Jun 14, 2018

By Danny Milrad

Unit 42

HenBox: Inside the Coop

On March 13, 2018, we published a blog describing a new Android malware family we discovered and called “HenBox” based on metadata found in most of the malicious apps. HenBox apps masquerade as others such as VPN apps, and Android system apps; some apps carry legitimate...

Apr 26, 2018

By Alex Hinchliffe, Mike Harbison, Jen Miller-Osborn and Tom Lancaster

Unit 42

Reaper Group’s Updated Mobile Arsenal

A recent post from EST Security revealed the use of Android spyware in spear phishing email attachments linked to the North Korean Reaper group (also known as APT37, Scarcruft, Group 123 or Red Eyes), highlighting a new mobile vector added to the threat group’s toolkit.

Apr 05, 2018

By Ruchna Nigam

Unit 42

TeleRAT: Another Android Trojan Leveraging Telegram’s Bot API to Target Ira...

Telegram Bots are special accounts that do not require an additional phone number to setup and are generally used to enrich Telegram chats with content from external services or to...

Mar 20, 2018

By Ruchna Nigam and Kyle Wilhoit

Unit 42

HenBox: The Chickens Come Home to Roost

Unit 42 recently discovered a new Android malware family we named “HenBox” masquerading as a variety of legitimate Android apps. We chose the name “HenBox” based on metadata found in most of the malicious apps...

Mar 13, 2018

By Alex Hinchliffe, Mike Harbison, Jen Miller-Osborn and Tom Lancaster

News of the Week

Palo Alto Networks News of the Week: February 10, 2018

Did you miss any of this week’s Palo Alto Networks action? Don’t worry – we’ve rounded up our top news and views right here:

Feb 10, 2018

By Justin Hall

Products and Services, Service Providers

Mobile Android Is an Even Bigger Opportunity for Attackers Than Windows PCs

Mobile Android is now a bigger threat opportunity than Windows PCs – in terms of shipments, usage, installed base and the number of vulnerable targets...

Feb 07, 2018

By Terry Young

Threat Brief

Threat Brief: Meltdown and Spectre Vulnerabilities

In the past 48 hours, there has been a flurry of activity as hardware and software vendors move to address two sets of vulnerabilities that have been dubbed “Meltdown” and “Spectre”.

Jan 04, 2018

By Christopher Budd

Threat Brief

2 Minute Threat Brief: Android Toast Overlay Attack

Unit 42 released details about a vulnerability that affects Android devices running operating systems older than 8.0 Oreo. The vulnerability leaves Android users at risk of falling victim to an Android Toast Ov...

Sep 14, 2017

By Eila Shargh

Threat Brief, Unit 42

Threat Brief: Patch Today and Don’t Get Burned by an Android Toast Overlay

Today, Palo Alto Networks Unit 42 researchers are announcing details on a new high- severity vulnerability affecting the Google Android platform. Patches for this vulnerability are...

Sep 07, 2017

By Christopher Budd

Unit 42

Android Toast Overlay Attack: “Cloak and Dagger” with No Permissions

Palo Alto Networks Unit 42 researchers have uncovered a high severity vulnerability in the Android overlay system, which allows a new Android overlay attack by using the “Toast typ...

Sep 07, 2017

By Cong Zheng, Wenjun Hu, Xiao Zhang and Zhi Xu

News of the Week

Palo Alto Networks News of the Week – July 8, 2017

Did you miss any of this week’s Palo Alto Networks action? Don’t worry – we’ve rounded up our top news and views right here:

Jul 08, 2017

By Justin Hall

Unit 42

SpyDealer: Android Trojan Spying on More Than 40 Apps

With the prevalence of Google Android smartphones and the popularity of feature-rich apps, more and more people rely on smartphones to store and handle kinds of personal and business information which attracts...

Jul 06, 2017

By Wenjun Hu, Cong Zheng and Zhi Xu

Unit 42

Ewind – Adware in Applications’ Clothing

Since mid-2016 we have observed multiple new samples of the Android Adware family “Ewind”. The actors behind this adware utilize a simple yet effective approach – they download a popular, legitimate Android app...

Apr 11, 2017

By Yaron Samuel and Simon Conant

Unit 42

Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA

This blog is the result of joint research between Unit 42 and Eyal Sela ClearSky Cyber Security. Over the past few months Palo Alto Networks have been working together with ClearSk...

Apr 05, 2017

By Tomer Bar and Tom Lancaster

Unit 42

Google Play Apps Infected with Malicious IFrames

Recently, we have discovered 132 Android apps on Google Play infected with tiny hidden IFrames that link to malicious domains in their local HTML pages, with the most popular one having more than 10,000 install...

Mar 01, 2017

By Xiao Zhang, Wenjun Hu and Shawn Jin

Unit 42

PluginPhantom: New Android Trojan Abuses “DroidPlugin” Framework

Recently, we discovered a new Google Android Trojan named “PluginPhantom”, which steals many types of user information including: files, location data, contacts and Wi-Fi informati...

Nov 30, 2016

By Cong Zheng and Tongbo Luo

Unit 42

DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices

Over the past two years, we’ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices. This attack vector is increasingly popular with mal...

Sep 13, 2016

By Claud Xiao

Events, News of the Week

Palo Alto Networks News of the Week – July 30, 2016

Unit 42 had a busy week! Researchers Robert Falcone and Jen Miller-Osborn observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive.

Jul 30, 2016

By Anna Lough

Load more blogs