‘Alien’ Password-Stealing Malware: See List Of Android Apps Affected

KEY POINTS

A new kind of password-stealing malware has been discovered
The "Alien" malware has the ability to steal user data from 226 widely-used Android apps
These include Facebook, Instagram, Twitter, Gmail, WhatsApp and e-banking apps

A new advanced malware capable of stealing passwords and contacts and give malicious users remote control over infected smartphones has been discovered. And the number of apps affected by the new strain of malware should cause a lot of concern.

Security researchers from ThreatFabric have revealed that a new malware called “Alien” has been doing nefarious work since the start of the year, giving people behind it access to a variety of private information belonging to those whose smartphones it has infected.

According to ThreatFabric, Alien is capable of stealing sensitive credentials from 226 apps. While most of these apps are used for banking purposes, some of them are very popular and are widely-used on a daily basis, such as Facebook, Instagram, Twitter and Gmail.

Alien is built on the source code belonging to a rival malware gang called “Cerberus.” The older trojan was offered as a Malware-as-a-Service (MaaS) last year but died out after Google found a way to detect it and clean the devices it has infected. Alien came after Cerberus, and although it is built on the older malware's code, it appears to be more advanced.

Alien has a slew of capabilities that make it a threat for everyone whose transactions are mostly done on their smartphones. These include:

Overlaying content on top of other apps (primarily used acquire login info)
Keylogging (logging keyboard input)
SMS harvesting: listing and forwarding SMS messages
Device info collection
Contact list collection
Collecting location data
Listing installed apps
Remote access
Installing apps on device
Starting apps
Removing apps from device
Remote screen locking

This list is not exhaustive. Alien is also capable of doing other things to an infected device, such as tweaking push notifications, forwarding calls and so on. The malware also has the ability to hide app icons (primarily to hide trojan app icons) and prevent its removal from the system.

Facebook said a group of Chinese users were using falsified accounts seeking to influence the US election, but did not link the actions to the Beijing government — The Facebook logo is pictured. AFP / Lionel BONAVENTURE

Gaetan van Diemen, a malware analyst at ThreatFabric, told ZDNet that “a lot of [Alien] seems distributed via phishing sites, for example malicious page tricking the victims into downloading fake software updates or fake Corona apps (still a common trick at the moment).”

That said, consumers are advised to avoid installing apps from dubious websites, much less grant them admin rights.

Here's a list of apps Alien has targeted (the full list, including app package names, can be seen via ThreatFabric):