Android Geo-Location Spyware Installed By Up To 5 Million Users

Android spyware SMSVova managed to dupe users into thinking it offered a system update app, but instead secretly operated in the background and revealed victims' real-time geo-location data to attackers, according to researchers at cloud security company Zscaler ThreatLabz.

After the app gets downloaded and the user tries to fire it up, it would abruptly quit and deliver a message that the update service had stopped. But in reality, the app would hide itself and operate in the background.

SMSVova spyware would then grab the victim's most current location and set up shared preferences, which is one of the many methods Android uses to store an application's data.  The Android spyware would also allow attackers to send out a text message with "get faq" and SMSVova would respond to a set of commands, according to Zscaler.

SMSVova, which has garnered between 1 million to 5 million downloads, has managed to fly under the radar for awhile, ducking detection by Google since it was last updated in December 2014. Google has since removed the app from its Play Store, after receiving notice of its nefarious purpose from Zscaler.

Read more about SMSVova here.

[A session on "Who are the Bad Guys? Cyber Criminals and Their Motivations" will be presented as part of the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 & 16, where Dark Reading editors and some of the industry's top cybersecurity experts will share the latest data security trends and best practices.]