U.S. mobile users have received the notice from the Federal Bureau of Investigation (FBI) and the United Kingdom’s intelligence agency GCHQ this Wednesday to act immediately following a new cybersecurity alert.
What the alert is all about are two forms of Chinese spyware—MOONSHINE and BADBAZAAR—embedded in fake apps that pretend to be famous communication platforms such as WhatsApp and Skype. These seem to be the examples of the malware, which once being there in the phone, are able to obtain your personal data, like messages, photos, and real-time location.
RelatedPosts
In a joint advice report sent out by the UK’s National Cyber Security Centre (NCSC) and the FBI, the researchers made clear that the affected application can also as well as a phone’s camera and microphone be a listening and visual device for the attacker without the victim’s consent. The computational forensics reveals that the programs implement cyber espionage that meets the Chinese government’s objectives,
“These malicious applications can collect data that I believe would be definitely interesting if not essential to Chinese state entities,” the NCSC announced.
Malfunctions Of Malware To Gain Trust
These hidden apps were seen to be in the list of those provided by the cybersecurity community, which is supposed to be fully authorized., Do not be surprised to see decoy applications such as Tibet One, and Audio Quran among other fluently known IMs like WhatsApp and Skype mostly used by people who barely have any communication, besides the main reason being to be in touch.
We now have good reasons to believe that these apps are the malicious ones as it will, for example, this malware directly interfere with the communication of people in the extremist group as the app Daily Stormer did.
FBI and NCSC Recommend Four Actions to Keep Safe
In reaction to the threat, the U.S. government has suggested people to get familiar with the following cyber hygiene habits:
- Stay Mainstream: Dowload from official app stores such as Apple’s App Store and Google Play only.
- Stay Organized: Regularly check and manage app permissions.
- Stay in Touch: Report suspicious behavior or files to cybersecurity services.
- Stay Safe: Be wary of shared links and files from unknown sources.
Indicators of a Malicious App
Moreover, professionals in cybersecurity have issued an eight-point list of criteria to allow users to distinguish risky apps from normal ones:
- Suspicious or overly positive reviews
- Poor grammar in app descriptions
- Low download count
- Unknown or unverifiable developer
- High download count shortly after release
- Excessive permission requests
- Unusual update frequency
- Low-resolution or distorted app icons
Many of these warnings are contained in the app listings of both the iOS and Android platforms.
Watch for Privacy Infringement if You are a U.S. Citizen
Even though the majority of the known victims come from the Asian continent, professionals advise that U.S. citizens should not let their guard down. The malware’s special architecture allows the collection of real-time data from a distance, which could pose a real threat to not only civil liberties but also to the national security and personal privacy.
A senior FBI spokesperson pointed out that the very individuals who may unknowingly go against foreign governments could be victims of tracking and data theft.
“The spyware could convert any mobile phone into a device that can be used for spying in real-time,” the officer mentioned.
Worldwide coordination
The warning was issued within the framework of the intelligence services of the United States, the United Kingdom, Canada, Australia, New Zealand and Germany sharing their data with one another. They intend to put an end to what they see as a “growing cyber threat” from Chinese state-sponsored actors.
Ultimate Caution
According to the authorities, the general public is strongly recommended to be very careful with the unknown mobile apps. Those users who think they have unintentionally downloaded a malicious app are asked to remove it, change their passwords, and report the incident to the police or security professionals.
Furthermore, the public is called to strictly adhere to official sources for information and complete an outright ban on third-party app downloads.
