3

The android spinmaze malware is characterised by the unrequested installation of the "spinmaze" application, and repeated popup messages of the form "Shortcut spinmaze already exists". The application reappears if deleted.

I've searched for further information about what is happening and how, but currently the information seems very speculative and light. Currently what I've heard is:

  • It is due to an update in TouchPal - which is the default keyboard on OPPO phones.
  • It is a browser hijacker.
  • Stopping the TouchPal components and installing and switching to GBoard(or similar) fixes it.

What I'm not clear about is

  • How and why did this find its way into TouchPal?
  • What is the browser hijacker trying to do, and how was it installed?
  • What is the purpose of the SpinMaze application/shortcut?

What is known about these issues, and what evidence is supporting these claims?

Improve this question
1

1 Answer 1

Reset to default
1

I cannot give you explicit answers to the questions you posed (how and why did it get in, what is it up to, purpose). However, I am concerned enough about the possible ongoing security threat posed by the fact that TouchPal is presinstalled on some or all AT&T Android-based smart phones (hard to say for sure since AT&T inexplicably removed my 2022 Nov. 4 post identifying SpinMaze and its connection to the TouchPal keyboard and insisted elsewhere that you should simply factory reset your phone, which of course does not work since it is factory installed).

Here is what I know:

  1. TouchPal is developed by CooTek/Cayman, a Chinese company (PRC).
  2. May 2022 CooTek/Cayman delisting proceedings at the NYSE were begun, ostensibly only because they failed to "maintain an average global market capitalization over a consecutive 30 trading day period of at least $15,000,000."
  3. TouchPal is known to be pushing adware: Reddit discussion

And specifically the SpinMaze problem: Reddit discussing SpinMaze

And recent Google Play: Google Play Touchpal comments re pushing adware

My personal experience is that I discovered the SpinMaze icon on my ZTE Maven 3 AT&T phone last week for the first time and couldn't find it listed in the settings-->apps. I was surprised that AT&T knew nothing about it: AT&T ignorance Worse, as you can see, AT&T closed the post though another customer had already told them (albeit in Spanish) that reset of the phone did not work (because TouchPal is AT&T factory installed and simply reinstalls, then pushes SpinMaze again).

I posted an update at AT&T twice telling them that I had fixed my own phone by removing SpinMaze from the display and then disabling and removing the TouchPal keyboard app (unhide system apps to find it), but as I say, they inexplicably removed it (possibly simply the usual corporate insolence, with a dose of self-protection, i.e., want to preserve deniability for the ongoing apparent change in behavior of TouchPal).

Given the above (and the beebom article in the comment above), my own suspicion is that CooTek/Cayman is not making enough legitimate income and has decided to start pushing adware and possible more serious phishing vectors (if SpinMaze takes the user to a Chinese website that is a recipe for trouble). Or, supreme poobah Xi Jinping has coopted more of the previously commercial/civilian sector of PRC industry for other activities.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .