Cybersecurity researchers have uncovered a sophisticated Android spyware campaign involving SpyNote malware cleverly disguised as legitimate applications, including Google Translate, hosted in unsecured open directories across the internet.

This discovery highlights the evolving tactics employed by cybercriminals to distribute malicious software through seemingly innocuous servers and exploit users’ trust in popular applications.

SpyNote represents a significant threat to Android users, particularly after its source code was leaked in late 2022, enabling widespread deployment by various threat actors.

Hunt.io threat intelligence analysts identified multiple samples of this spyware masquerading as trusted applications such as Google Translate, Temp Mail, and Deutsche Postbank, demonstrating the malware’s versatility in social engineering attacks.

Malicious Temp Mail application (Source – Hunt.io)

The malware exploits Android’s accessibility services and device administrator privileges to steal sensitive information including device location, contacts, SMS messages, and other personal data.

These SpyNote samples routinely employ deception tactics, utilizing legitimate application icons and interfaces to trick users into believing they are installing harmless software while silently collecting their private information.

The research revealed that SpyNote’s distribution infrastructure spans multiple hosting providers and geographic locations, making detection and takedown efforts more challenging.

The malware’s operators have established command and control networks using dynamic DNS services and cloud hosting platforms to maintain persistent communication channels with infected devices.

Analysis of the Google Translate Impersonation

The most notable discovery involved a SpyNote sample hosted on Amazon Web Services at IP address 18.219.97.209:8081, containing files named “Google.apk” and “Translate.apk” that were identical malicious applications with SHA-1 hash 3aad911b21907053a69b49086a6396c50714accb.

Accessibility services request screen (Source – Hunt.io)

Upon installation, the malicious application perfectly mirrors the legitimate Google Translate interface, but analysis revealed a critical developer oversight in the accessibility permissions request screen, displaying the placeholder text “Enable [MY-NAME]”.

Once activated, the malware establishes communication with its command and control server at kyabhai.duckdns.org:8080, hosted on the same IP address as the distribution point.

This configuration demonstrates a sophisticated yet operationally secure approach to malware deployment, where attackers maintain control over both distribution and command infrastructure while minimizing external dependencies that could compromise their operations.

Power up early threat detection, escalation, and mitigation with ANY.RUN’s Threat Intelligence Lookup. Get 50 trial searches.

The post Android Spyware SpyNote That Mimicked Google Translate Hosted in Open Directories appeared first on Cyber Security News.