The Nigerian Communications Commission, NCC, has said there is a new android malware gaining access to smartphones and taking control of infected phones.
In a statement signed by the commission’s Director, Public Affairs, Ikechukwu Adinde, the NCC said the malware is called AbstractEmu and can gain access to smartphones, take complete control of infected smartphones and silently modify device settings while simultaneously taking steps to evade detection.
According to the NCC, this discovery was made by the Nigerian Computer Emergency Response Team. The commission claimed that the malware is distributed through Google Play Store and other third-party stores.
The commission said, “AbstractEmu is distributed via Google Play Store and third-party stores such as the Amazon Appstore and the Samsung Galaxy Store, as well as other lesser-known marketplaces like Aptoide and APKPure.
“The advisory stated that a total of 19 Android applications that posed as utility apps and system tools like password managers, money managers, app launchers, and data saving apps have been reported to contain the rooting functionality of the malware.
“The apps are said to have been prominently distributed via the third-party stores and the apps include All Passwords, Anti-ads Browser, Data Saver, Lite Launcher, My Phone, Night Light and Phone Plus, among others.”
According to the commission, rooting malware is very dangerous, and uses the rooting process to gain privileged access to an android operating system.
The NCC added that once installed, the attack chain is designed to leverage one of five exploits for older Android security flaws that would allow it to gain root permissions.
The NCC said the malware will take over the device, install additional malware, extract sensitive data, and transmit to a remote attack-controlled server.
The commission said, “Additionally, the malware can modify the phone settings to give app ability to reset the device password, or lock the device, through device admin; draw over other windows; install other packages; access accessibility services; ignore battery optimisation; monitor notifications; capture screenshots; record device screen; disable Google Play Protect; as well as modify permissions that grant access to contacts, call logs, Short Messaging Service (SMS), Geographic Positioning System (GPS), camera, and microphone.”
The NCC said ngCERT advises users to be wary of installing unknown or unusual apps, and look out for different behaviours as they use their phones. It added that users should reset their phones to factory settings when there is suspicion of unusual behaviours.