ViceLeaker

ViceLeaker is the name of a newly discovered malware strain that targets Android devices. Unlike many other pieces of Android-compatible malware, this one does not appear to target random users and devices – instead, almost all of its victims are situated in Middle Eastern countries and, more specifically, Israel. The purpose of the malware is to collect information from the device, and this is a good enough reason to consider that the purpose of the ViceLeaker malware might be to monitor its victims.

Researchers who analyzed the sample of the ViceLeaker malware noticed some significant similarities between this threat and Triout, another Android malware that made the news in the summer of 2018. However, while Triout's attack did not appear to have a targeted, the same certainly cannot be said about ViceLeaker.

ViceLeaker Doubles as a Backdoor Trojan

Apart from being able to collect various information types from the compromised device, the ViceLeaker malware also could serve as a backdoor and allow the remote attacker to upload external files to the infected machine. This cannot only be used to plant additional Android malware, but the attackers also may opt to use it to store illicit content on the device and then try to frame the owner. ViceLeaker's features may include, but are not limited to:

• Take photos with the rear/front cameras and transfer them to the attacker's server.
• Download files from a URL.
• Upload a file from the device to the attacker's server.
• Collect all call logs and text messages.
• Use the microphone to record surroundings for up to 80 seconds.
• Browse the memory card.
• Collect browser history (default browser and Google Chrome).
• Receive a list of installed software.
• Send SMS messages.

To protect yourself from the ViceLeaker malware and similar threats, you should avoid downloading Android applications from untrustworthy Web destinations. Furthermore, it is not recommended to download unknown apps from the Google Play Store, since it is possible for cybercriminals to bypass its security measures and host potentially harmful files.