Researchers are warning about a fake version of the popular audio chat app Clubhouse, which delivers malware that steals login credentials for more than 450 apps.
The malicious app spreads the Black Rock malware, which steals credentials from 458 services – including Twitter, WhatsApp, Facebook & Amazon.
Audio-Chat Rooms
Clubhouse has launched into social media in recent months, gaining popularity through its audio-chat rooms where participants can discuss anything from politics to relationships.
Despite being invite-only, & only being around for 1 year, the app is closing in on 13m downloads. However, as of now the app is only available on Apple’s App Store mobile application marketplace – there’s no Android version yet (though plans are in the works to develop it).
Legitimacy
Cyber-criminals are targeting Android users wishing to download Clubhouse by creating their own fake Android version. To add a ‘feel’ of legitimacy to this scam, the fake app is delivered from a website pretending to be the real Clubhouse website – which “looks like the real deal,” commented Lukas Stefanko, researcher with ESET.
“To be frank, it is a well-executed copy of the legitimate Clubhouse website,” stated Stefanko last Fri. “However, once the user clicks on ‘Get it on Google Play’, the app will be automatically downloaded onto the user’s device. By contrast, legitimate websites would always redirect the user to Google Play, rather than directly download an Android Package Kit, or APK for short.”
Social Media
It is unknown how this website is discovered by potential victims, but Stefanko explained the website is most likely spread via social media, or 3rd-party websites like forums.
The fraudulent website (joinclubhouse[.]mobi) looks identical to the real Clubhouse website (joinclubhouse.com), & both tell users that they can join with an invite from an existing user, with the call to action: “Sign up to see if you have friends on Clubhouse who can let you in.”
Fake Site
While the real website points to users to download the app on the store, the fake site tells users to get the app on Google Play.
However, upon more intense inspection, the fake website has ‘red flags’ tipping off potential victims that something is wrong – such as the connection being HTTP rather than HTTPS, & the fact that the site uses the .mobi top-level domain (rather than the .com used by the legitimate domain).
Black Rock
If the target clicks on the button that purports to download the app, a trojan called Black Rock is installed on their system. This malware, discovered last July, is a variant of the LokiBot trojan that attacks not just financial & banking apps, but also a huge list of well-known & commonly used brand-name apps on Android devices.
“The trojan – nicknamed “Black Rock” by Threat Fabric & detected by ESET products as Android/TrojanDropper.Agent.HLR – can steal victims’ login data for no fewer than 458 online services,” observed researchers.
The targeted list of app credentials includes well-known financial & shopping apps, cryptocurrency exchanges & social media & messaging apps – including Twitter, WhatsApp, Facebook, Amazon, Netflix, Outlook, eBay, Coinbase, Plus500, Cash App, BBVA & Lloyds Bank.
Overlay Attack
The trojan steals credentials using an ‘overlay attack’ – which is a common type of attack for malicious Android apps. In this attack, the malware will create a data-stealing overlay of the application that the victim is navigating to, & request the user to log in. However, while the victim believes he is logging in, he is actually handing over credentials to the cyber-criminals.
In a commonly-used method by Android malware, the malicious app also asks the victim to enable accessibility services on the phone in order to grant itself permissions on the phone without the victim knowing (Android says that accessibility services are typically used to assist users with disabilities in using Android devices and apps).
SMS Messages
These permissions give the malware access to contacts, camera, SMS messages etc. This ability to intercept SMS messages is also useful for threat players looking to get around SMS-based 2-factor authentication (2FA) protections set up by the apps on the victims’ phone, (if an app sends a 2FA code, for example, attackers can pick it up via viewing the text messages).
The greatest clue that this app is malicious is that its name is “Install” rather than “Clubhouse,” Stefanko commented.
“While this demonstrates that the malware creator was probably too lazy to disguise the downloaded app properly, it could also mean that we may discover even more sophisticated copycats in the future,” he suggested.
Various Privacy Issues
As its popularity grows, Clubhouse has come under attack for various privacy issues, such as the fact that conversations via the app are recorded. France’s privacy watchdog also recently opened an investigation into the app over how it protects the privacy of European users’ data.
While this malicious app is in no way linked to the legitimate Clubhouse app itself, researchers warn that more phoney Clubhouse apps will appear in the future – particularly whilst the demand for a yet-to-be rolled out Android version continues.
Android users can protect themselves by always sticking to official mobile app marketplaces to download apps to their devices, being wary of the permissions they grant to applications & keeping their devices up to date (via patching etc).
https://www.cybernewsgroup.co.uk/virtual-conference-april-2021/
