Security firm McAfee has discovered a new Android virus called SpyAgent that can steal private keys stored in screenshots and images on smartphones.
How SpyAgent Works
The malware uses Optical Character Recognition (OCR) to scan images stored on a smartphone and extract words from them. OCR is present in many modern technologies, including desktop computers, which can recognize, copy, and paste text from images.
Malware Distribution
According to McAfee Labs, the malware is distributed through malicious links sent via text messages. Upon clicking the link, the user is redirected to a seemingly legitimate website and prompted to download an application that appears trustworthy but is in fact the SpyAgent malware. The fraudulent programs disguise themselves as banking apps, government services, and streaming platforms, prompting users to grant access to contacts, messages, and local storage. The malware is mainly targeting South Korean users and has been detected in over 280 fraudulent apps.
Rise of Malware Attacks in 2024
In August 2024, similar malware for MacOS called Cthulhu Stealer was identified, which also disguised itself as legitimate software and stole personal information, including MetaMask passwords and private keys. During the same month, Microsoft discovered a vulnerability in Google Chrome's web browser, exploited by the North Korean hacker group Citrine Sleet to create fraudulent cryptocurrency exchanges and distribute malware. These incidents led the FBI to issue a warning about the rising number of malware attacks.
According to McAfee reports, the SpyAgent virus poses a significant threat to Android users as it can steal private keys from images. Users are advised to be cautious with suspicious links and verify the legitimacy of downloaded apps.
Comments