copycat malware targets the rooted devices

                           

                            

what is copycat malware?
new piece of adware dubbed copycat malware has capabilities to root infected device, establish persistence and inject malicious code into Zygote- a daemon responsible for launching apps on android and providing full access to the devices.according to research at security firm check point it has infected 14 M android devices around the world.

how many devices infected from this malware ?
copycat malware has infected 14 million device ,nearly 8 million of them are rooted and device serve ads, and 4.4 million of  them were used to steal credit for installing apps on google play.

the malware uses two tactics to abuse the zygote process and steal ad revenue .it displays fraudulent pop-up ads on a user's screen and steal app installation credits. it also installs fraudulent apps directly on to the device.

how copycats works?

as check point explained, advertisers are paid for display ads that lead to the installation of certain apps. copycats scams the mobile analytics platform tune to fraudulently earn its revenue.

"copycat retrieves the package name of the app that the user is  viewing in google play, and sends it to its command  and control server," the researchers wrote."the server sends back a referrer ID suited for the package name. this referrer ID belongs to the creators of the malware, and will later be used to make sure the  revenue for the installation is credited to them."

how the copycat malware spread?  

there is no evidence on who is behind the copycat malware campaign , researchers  at check point found below-mentioned connections that indicate hackers might have  used  chinese ad advertising network 'mibisummer' for the distribution of the malware.

copycat has managed to root 8 million of the 14 million  devices it has  infected. the campaign  peaked between march and may 2016, spreading through phishing scams and popular  apps that  
were repackaged with the malware and offered for download on third party apps stores. check point 
said there's 'no evidence' malware made its way into google play.

"according to google" , they were able to quell the campaign, and the current number of infected devices is far lower it was at  the time of campaign peak ,check point wrote:"unfortunately , device infected by copycat may still be affected by the malware even today."