xHelper “undeletable” Trojan smittet 45,000 Android-enheter

Den xHelper Trojan, laget for Android-enheter, was first noticed by experts in the spring of this year, but the first detailed report on the problem appeared in August, when Malwarebytes experts rapportert that the malware had already infected 35,000 enheter.

Symantec experts publisert a review on the malware and claim that the number of infected devices has already exceeded 45,000, and on average xHelper infects 131 new victims per day (handle om 2,400 new victims per month), most of which were found in India, the USA and Russia.

“The main source of infections are redirects and suspicious sites that forward users to pages with Android applications. Such sites instruct the user in detail how to download applications not from Google Play, and the code hidden in the applications ultimately leads to the loading of xHelper”, – say researchers.

xHelper is currently displaying intrusive pop-up ads and spam alerts to its victims. typisk, such ads and notifications lead users to the Play Store, where they are invited to install other applications. XHelper operators earn commissions that they receive for each such installation. Neverthelss, the malware has other, much more dangerous functions.

Both companies write that xHelper can download and install other applications. And malware operators can use this feature to deploy second-level threats, including ransomware, bank trojans, og så videre.

“However, the most interesting feature of xHelper is that it does not work like most Android malware When the trojan gains access to the device through the initial application, xHelper installs itself as a separate standalone service. Endelig, removing the original application does not remove xHelper, and the malware will continue to display ad windows and notifications”, — warn the researchers.

Verre, even if the victim finds the xHelper service in the OS settings, deleting it will not help the case, as the trojan is reinstalled every time, even if the user resets the device to the factory settings.

LESE  Eksperter har funnet en forbindelse mellom Carbanak og en av gruppene MageCart

I noen tilfeller, users complained that even uninstalling the xHelper service and disabling the ability to install applications from unknown sources did not help: the device appeared to be re-infected literally a few minutes after cleaning, and the option “install apps from unknown sources” turned out to be active again. Such discussions can be found on Reddit, among the topics on the Google Play Help.

Les også: Casbaneiro banktjenester Trojan brukt YouTube til å stjele kryptovaluta

Samtidig, experts from Malwarebytes and Symantec were not able to understand how xHelper “survives” after this. There was no Trojan interference in the operation of system applications and services, and Symantec believes that xHelper is unlikely to be preinstalled on devices out of the box, although the malware actually appears more often on devices of specific brands. Despite these facts, many users believe that this is the case and urge others not to buy cheap Chinese phones.

[Totalt:0    Gjennomsnitt:0/5]

Om Trojan Killer

Carry Trojan Killer Portable på minnepinne. Vær sikker på at du er i stand til å hjelpe din PC motstå eventuelle cyber trusler uansett hvor du går.

Sjekk også

Fjern Wudfhosts.exe Miner: Enkle trinn for å avinstallere

En ny, very harmful cryptocurrency miner virus has actually been detected by safety and security

Hvordan fjerne Audioddx.exe CPU Miner Trojan

En ny, veldig farlig kryptovaluta miner virus har faktisk blitt oppdaget av trygghet og sikkerhet …

Legg igjen et svar