{"id":203552,"date":"2024-11-25T05:00:06","date_gmt":"2024-11-25T13:00:06","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=203552"},"modified":"2024-11-24T23:42:58","modified_gmt":"2024-11-25T07:42:58","slug":"spyloan-a-global-threat-exploiting-social-engineering","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyloan-a-global-threat-exploiting-social-engineering\/","title":{"rendered":"SpyLoan: A Global Threat Exploiting Social Engineering"},"content":{"rendered":"

Authored by: Fernando Ruiz<\/em><\/p>\n

The <\/span>McAfee mobile research team <\/span>recently<\/span> identified<\/span> a<\/span> significant <\/span>global<\/span> increase<\/span> of <\/span>SpyLoan<\/span>, also know<\/span>n<\/span> as<\/span> predatory loan<\/span>\u00a0apps<\/span>,<\/span> on Android<\/span>.<\/span> These <\/span>PUP (potentially unwanted programs)<\/span> applications use <\/span>social engineering<\/span> tactics to trick users into providing sensitive information and granting <\/span>extra mobile app <\/span>permissions,\u00a0<\/span><\/span> which can lead<\/span> to extortion, harassment, and <\/span>financial loss<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

During our investigation of this threat, we <\/span>identified<\/span> fifteen apps with a combined total of over eight million installations<\/span>.\u00a0 <\/span>This group of loan apps share a common framework to encrypt and exfiltrate data from a victim\u2019s device to a command and control (C2) server using a similar HTTP endpoint infrastructure. They <\/span>operate<\/span> localized in targeted territories, <\/span>mainly in<\/span> South America, Southern Asia, and Africa, with some of them being promoted through deceptive advertising on social media. <\/span><\/span>\u00a0<\/span><\/p>\n

McAfee is a member of the App Defense Alliance focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem. We reported the apps discovered to Google <\/span>who<\/span> have notified<\/span> the developers that their apps violate Google Play policies and fixes are needed to come into compliance. Some apps were suspended from Google Play while others were updated<\/span> by the developers<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

McAfee Mobile Security detects all of these apps as Android\/<\/strong><\/span>PUP.SpyLoan<\/span><\/strong> due to our PUP policy since even after some apps have updated to reduce the permissions requirements and the harvesting of sensitive information they still pose a risk for the user\u2019s privacy due to the potential unethical practices that can be conducted by the operators of these apps that are not licensed or registered with the authorities that regulate financial services in each jurisdiction where they operate.<\/span><\/span>\u00a0<\/span><\/p>\n

 <\/p>\n

\"\"<\/p>\n

Figure 1: Examples of SpyLoan apps recently distributed on Google Play<\/figcaption><\/figure>\n

Since 2020, <\/span>SpyLoan has <\/span>become<\/span> a <\/span>consistent<\/span> presence<\/span>\u00a0<\/span>\u00a0<\/span><\/span> in the mobile threat landscape<\/span>. However, our telemetry <\/span>indicates<\/span> a rapid surge in their activity recently. Fr<\/span>om the end of Q2 to the end of <\/span>Q3 2024, the number of malicious SpyLoan apps and unique infected devices has increased by over 75%<\/span>.\u00a0<\/span>\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

Understanding the Threat<\/strong><\/h2>\n

What Are SpyLoan Apps?<\/strong><\/h3>\n

SpyLoan apps are <\/span>intrusive<\/span> financial applications that <\/span>lure users with promises of<\/span> quick and flexible loans, often <\/span>featuring low rates and minimal requirements. Wh<\/span>ile these apps <\/span>may <\/span>seem to <\/span>offer genuine value, the reality is that these apps primarily exist to collect as much personal information as possible, which they then<\/span> may<\/span> exploit to harass and extort users into paying predatory interest rates. They employ questionable tactics, such as deceptive marketing that highlights time-limited offers and countdowns, creating a false sense of urgency to pressure users into making hasty decisions. <\/span>Ultimately, rather<\/span> than providing genuine financial <\/span>assistance<\/span>, these apps can lead users into a cycle of debt and privacy violations.<\/span><\/span>\u00a0<\/span><\/p>\n

While the specific<\/span> behavior may vary by country, these apps share common characteristics<\/span> and code at app and infrastructure level:<\/span><\/span>\u00a0<\/span><\/p>\n