Regarding recently emerging Skygofree trojan for mobile devices, having read the following article Secure list / Skygofree summary it is still unclear to me how the device is getting affected with that Trojan, article mentions that there are many android implants on the web landing pages, but what actually they are *.apk file disguised as *.jpg file or what actually?

Even if it's a *.apk file guised into *.jpg file that will not be run on targeted device because, due to the strict security policy of Android platform, you have to get permissions from user which will alert him/her, so IMHO that won't be very savvy move.

So coming back to my question, how do they have planned(SkygoFree team) to infect the mobile device if there wasn't any obvious path to do that other than loading direct *.apk file with all permissions? Where I'm sure that astute persons will immediately notice and terminate the attack.

Can you shed some lights on that ?

  • I think that the idea is indeed just getting people to install the *.apk file on their phone through phising sites that mimic cellservice provider sites. And tell them they need to download these settings for their phone to work well. People tend to just click through warnings when they think they can trust a site that looks like a site they know. So astute persons would only be a small portion of humanity. :P – Wealot Jan 22 '18 at 15:17

From the Kaspersky blog:

The malware is distributed through fake mobile operator websites, where Skygofree is disguised as an update to improve mobile Internet speed.

There's probably a lot of people on the Internet who will easily trade all their privacy and security for a slightly faster network connection.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.