A new form of Android spyware embedded in functional fake apps is one of the most sophisticated ever seen, according to a new report today.

Discovered by cybersecurity researchers at Lookout Inc. and dubbed “Monokle,” the spyware is said to have been developed by Russia-based company Special Technology Centre Ltd., which was sanctioned by the U.S. government in connection to alleged interference in the 2016 presidential elections.

The spyware toolset, which is believed to have been developed as far back as 2015, was first observed in the wild in 2016, with infections peaking in 2018, but until recently it had not been identified.

The infection path for Monokle is trojanized versions of what are designed to look like legitimate apps. Following a recent trend in malware, the trojanized apps operate as intended, with the spyware operating in the background. That means the victims are not aware that they have malicious apps and because the apps work, they’re far less unlikely to uninstall them.

Many of the apps discovered by the researchers primarily targeted users in the Caucasus region and well as users in and around Syria, but some apps popular in the west were found copied and trojanized as well. Some of the fake apps found included those for Skype, Signal and Pornhub.

Once a user installs the fake but functional app, Monokle gets to work. In its first stage, the spyware enables so-called man-in-the-middle attacks by allowing those behind it to install their own malicious certificates on the infected device. That’s a unique feature, according to the researchers.

After that, Monokle’s features read like a shopping list of just about every known form of surveillance. The spyware can harvest and exfiltrate data from many popular applications; record users’ device screens to capture their PINs, patterns and passwords; steal contacts, call histories, browser histories and calendar information; record calls and local audio; capture user passwords of websites; retrieve emails, take screenshots, track the location of a device; and more.

“Monokle is a great example of the larger trend of enterprises and nation-states developing sophisticated mobile malware that we have observed over the years,” the researchers noted in a blog post.

Photo: Maxpixel