{"id":90299,"date":"2018-07-12T06:00:42","date_gmt":"2018-07-12T13:00:42","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=90299"},"modified":"2024-02-17T10:23:53","modified_gmt":"2024-02-17T18:23:53","slug":"google-play-users-risk-a-yellow-card-with-android-foulgoal-a","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/","title":{"rendered":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A"},"content":{"rendered":"<p><em>This blog post was co-written by Irfan Asrar.<\/em><\/p>\n<p>English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune <a href=\"https:\/\/www.youtube.com\/watch?v=RJqimlFcJsM\">\u201cThree Lions\u201d<\/a> plays in their heads, while hoping to end 52 years of hurt. Meanwhile a recent spyware campaign distributed on Google Play has hurt fans of the beautiful game for some time. Using major events as social engineering is nothing new, as phishing emails have often taken advantage of disasters and sporting events to lure victims.<\/p>\n<p>\u201cGolden Cup\u201d is the malicious app that installs spyware on victims\u2019 devices. It was distributed via Google Play, and \u201coffered\u201d the opportunity to stream games and search for records from the current and past World Cups. McAfee Mobile Security identifies this threat as Android\/FoulGoal.A; Google has removed the malicious applications from Google Play.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-90304\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\" alt=\"\" width=\"723\" height=\"907\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png 723w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-1-239x300.png 239w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-1-399x500.png 399w\" sizes=\"auto, (max-width: 723px) 100vw, 723px\" \/><\/a><\/p>\n<p>Once Golden Cup is installed it appears to be a typical sporting app, with multimedia content and general information about the event. Most of this data comes from a web service without malicious activity. However, in the background and without user consent the app silently transfers information to another server.<\/p>\n<h2>Data captured<\/h2>\n<p>Golden Cup captures a considerable amount of encrypted data from the victim\u2019s device:<\/p>\n<ul>\n<li>Phone number<\/li>\n<li>Installed packages<\/li>\n<li>Device model, manufacturer, serial number<\/li>\n<li>Available internal storage capacity<\/li>\n<li>Device ID<\/li>\n<li>Android version<\/li>\n<li>IMEI, IMSI<\/li>\n<\/ul>\n<p>This spyware may be just the first stage of a greater infection due to its capability to load dex files from remote sources. The app connects to its control server and tries to download, unzip, and decrypt a second stage.<\/p>\n<p>Android\/FoulGoal.A detects when the screen is on or off and records this in its internal file scrn.txt, with the strings \u201con\u201d or \u201coff\u201d to track when users are looking at their screens:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-90305\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-2.png\" alt=\"\" width=\"998\" height=\"156\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-2.png 998w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-2-300x47.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-2-768x120.png 768w\" sizes=\"auto, (max-width: 998px) 100vw, 998px\" \/><\/a><\/p>\n<p>The Message Queuing Telemetry Transport protocol serves as the communication channel between the device and the malicious server to send and receive commands.<\/p>\n<h3>Data encryption<\/h3>\n<p>User data is encrypted with AES before it is sent to the control server. Cryptor class provides the encryption and decryption functionality. The doCrypto function is defined as a common function. As the first parameter of the function, \u201c1\u201d represents encryption and \u201c2\u201d is decryption mode:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-3.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-90306\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-3.jpg\" alt=\"\" width=\"803\" height=\"363\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-3.jpg 803w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-3-300x136.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-3-768x347.jpg 768w\" sizes=\"auto, (max-width: 803px) 100vw, 803px\" \/><\/a><\/p>\n<p>The encryption key is generated dynamically using the SecureRandom function, which generates a unique value on the device to obfuscate the data. The addKey function embeds the encryption key into the encryption data. The data with the key is uploaded to the control server.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-4.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-90307\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-4.jpg\" alt=\"\" width=\"668\" height=\"236\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-4.jpg 668w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-4-300x106.jpg 300w\" sizes=\"auto, (max-width: 668px) 100vw, 668px\" \/><\/a><\/p>\n<p>We believe the malware author uses this AES encryption technique for any information to be uploaded to escape the detection by Google Bouncer and network inspection products.<\/p>\n<p>Our initial analysis suggests there were at least 300 infections, which we suspect occurred between June 8\u201212, before the first World Cup matches began.<\/p>\n<h2>The second round<\/h2>\n<p>The second phase of the attack leverages an encrypted dex file. The file has a .data extension and is downloaded and dynamically loaded by the first-stage malware; it is extracted with the same mechanism used to upload the encrypted files. The location of the decryption key can be identified from the size of the contents and a fixed number in the first-stage malware.<\/p>\n<p>After decryption, we can see out.dex in zipped format. The dex file has spy functions to steal SMS messages, contacts, multimedia files, and device location from infected devices.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-5.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-90308\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-5.jpg\" alt=\"\" width=\"963\" height=\"276\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-5.jpg 963w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-5-300x86.jpg 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2018\/07\/20180711-Cup-5-768x220.jpg 768w\" sizes=\"auto, (max-width: 963px) 100vw, 963px\" \/><\/a><\/p>\n<p>The control server in second stage is different from the first stage\u2019s. The encryption methodology and the server folder structures on the remote server are identical to the first stage.<\/p>\n<p>We found one victim\u2019s GPS location information and recorded audio files (.3gp) among the encrypted data on the control server.<\/p>\n<h2>Variants<\/h2>\n<p>We have also discovered two other variants of this threat created by the same authors and published to Google Play as dating apps. Although all the apps have been removed from Google Play, we still see indications of infections from our telemetry data, so we know these apps are active on some users\u2019 devices.<\/p>\n<p>Our telemetry data indicates that although users around the world have downloaded the app, the majority of downloads took place in the Middle East, most likely as a result of a World Cup\u2013themed Twitter post in Hebrew directing people to download the app for a breakdown of the latest events.<\/p>\n<p>McAfee Mobile Security users are protected against all the variants of this threat, detected as\u00a0\u00a0 Android\/FoulGoal.A.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the&#8230;<\/p>\n","protected":false},"author":460,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[5526,37,76,180,214],"coauthors":[1359],"class_list":["post-90299","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-advanced-threat-research","tag-android","tag-cybercrime","tag-malware","tag-mobile-security1"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog<\/title>\n<meta name=\"description\" content=\"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-07-12T13:00:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-02-17T18:23:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\" \/>\n<meta name=\"author\" content=\"Raj Samani\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@raj_samani\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Raj Samani\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\"},\"author\":{\"name\":\"Raj Samani\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/c599d4c6fbfe639ab3c623dbab743efc\"},\"headline\":\"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A\",\"datePublished\":\"2018-07-12T13:00:42+00:00\",\"dateModified\":\"2024-02-17T18:23:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\"},\"wordCount\":741,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\",\"keywords\":[\"Advanced Threat Research\",\"android\",\"cybercrime\",\"malware\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\",\"name\":\"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\",\"datePublished\":\"2018-07-12T13:00:42+00:00\",\"dateModified\":\"2024-02-17T18:23:53+00:00\",\"description\":\"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/c599d4c6fbfe639ab3c623dbab743efc\",\"name\":\"Raj Samani\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/84322977b2e4d74026259dbee600b443\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/08\/Picture1-1-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/08\/Picture1-1-96x96.png\",\"caption\":\"Raj Samani\"},\"description\":\"Raj Samani is Chief Scientist and Fellow for the Enterprise business. He has assisted multiple law enforcement agencies in cybercrime cases and is a special advisor to the European Cybercrime Centre in The Hague. Samani has been recognized for his contribution to the computer security industry through numerous awards, including the Infosecurity Europe hall of Fame, Peter Szor award, and Intel Achievement Award, among others. He is the co-author of the book \\\"Applied Cyber Security and the Smart Grid\\\" and the \\\"CSA Guide to Cloud Computing,\\\" as well as technical editor for numerous other publications.\",\"sameAs\":[\"http:\/\/www.mcafee.com\/\",\"https:\/\/www.linkedin.com\/in\/raj-samani-3697b9\/\",\"https:\/\/x.com\/raj_samani\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/raj-samani\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog","description":"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog","og_description":"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2018-07-12T13:00:42+00:00","article_modified_time":"2024-02-17T18:23:53+00:00","og_image":[{"url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png","type":"","width":"","height":""}],"author":"Raj Samani","twitter_card":"summary_large_image","twitter_creator":"@raj_samani","twitter_site":"@McAfee","twitter_misc":{"Written by":"Raj Samani","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/"},"author":{"name":"Raj Samani","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/c599d4c6fbfe639ab3c623dbab743efc"},"headline":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A","datePublished":"2018-07-12T13:00:42+00:00","dateModified":"2024-02-17T18:23:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/"},"wordCount":741,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png","keywords":["Advanced Threat Research","android","cybercrime","malware","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/","name":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png","datePublished":"2018-07-12T13:00:42+00:00","dateModified":"2024-02-17T18:23:53+00:00","description":"This blog post was co-written by Irfan Asrar. English soccer fans have enthusiastically enjoyed the team\u2019s current run in the World Cup, as the tune","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2018\/07\/20180711-Cup-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/google-play-users-risk-a-yellow-card-with-android-foulgoal-a\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Google Play Users Risk a Yellow Card With Android\/FoulGoal.A"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/c599d4c6fbfe639ab3c623dbab743efc","name":"Raj Samani","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/84322977b2e4d74026259dbee600b443","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/08\/Picture1-1-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/08\/Picture1-1-96x96.png","caption":"Raj Samani"},"description":"Raj Samani is Chief Scientist and Fellow for the Enterprise business. He has assisted multiple law enforcement agencies in cybercrime cases and is a special advisor to the European Cybercrime Centre in The Hague. Samani has been recognized for his contribution to the computer security industry through numerous awards, including the Infosecurity Europe hall of Fame, Peter Szor award, and Intel Achievement Award, among others. He is the co-author of the book \"Applied Cyber Security and the Smart Grid\" and the \"CSA Guide to Cloud Computing,\" as well as technical editor for numerous other publications.","sameAs":["http:\/\/www.mcafee.com\/","https:\/\/www.linkedin.com\/in\/raj-samani-3697b9\/","https:\/\/x.com\/raj_samani"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/raj-samani\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/90299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/460"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=90299"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/90299\/revisions"}],"predecessor-version":[{"id":182890,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/90299\/revisions\/182890"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=90299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=90299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=90299"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=90299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}