Devious new Android malware uses a Microsoft tool to avoid being spotted

• McAfee found hackers using .NET MAUI to hide malicious code in Android apps
• The apps are being distributed via unofficial app stores and phishing messages
• The goal of the malware is to steal data

Cybercriminals are abusing a legitimate Windows tool to create malicious Android applications and steal their sensitive information, experts have claimed.

Security researchers from McAfee showcased two examples caught in the wild, claiming an unknown threat actor was abusing .NET MAUI, a cross-platform development framework to create Android malware capable of evading detection.

“These threats disguise themselves as legitimate apps, targeting users to steal sensitive information,” the report states.

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.

Preferred partner (What does this mean?)

View Deal

Phishing and fake app stores

There were multiple ways .NET MAUI was used to bypass security protections, McAfee further explained.

For one, the attackers were hiding the dangerous code inside a hidden storage area (blob files) where most antivirus programs don’t usually look.

Then, they used multi-stage dynamic loading (apps were loading small pieces of code one at a time, decrypting them as they go), to make it harder for security software to figure out what was going on.

Furthermore, they added unnecessary settings and permissions in the app’s files to confuse security scanners, and instead of using normal internet requests that security tools can monitor, these fake apps use encrypted messages and direct connections to send stolen data to the hackers.

The malicious apps were not present on any of the reputable app repositories, such as the Google Play Store. Instead, they were found on “unofficial” app stores, to which victims get redirected via phishing links and similar scams.

Among the malicious apps McAfee discovered a fake bank app and a fake SNS app targeting the Chinese-speaking community.

Both apps were tasked with silently stealing data and exfiltrating it to the attacker-owned C2 server.

As usual, the best way to defend against such threats is to only download apps from official repositories, and even then - being careful, reading reviews and other reports.

You might also like

• These malicious Android apps were installed over 60 million times - here's how to stay safe
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app