5 million Android devices infected by new malware. Is your smartphone safe?

The Check Point Mobile Security discovered a new malware which has infected nearly 5 million Android devices.
They gave the malware a name ‘RottenSys’ as it was initially disguised as a System Wi-Fi service.

• RottenSys, a mobile adware, has infected nearly 5 million devices since 2016.
• Indications show the malware could have entered earlier in the supplier chain.
• The attackers have been testing a new botnet campaign via the same C&C server.

How does RottenSys work?

The malware is earning fraudulent advertising revenue from the infected devices. The researchers say this may though change over time.
It has ability to download and install new software from it's command and control (C&C) server.
It has also recently started to turn millions infected devices into a massive botnet.

The criminals behind the malware earn over $11.000 US dollars each day by displaying ads on android users devices.

Evasion techniques.

The malware is designed to hide it's presence by not performing any suspicious activity during first days after installation. It only downloads malicious components at some later stage and not at the original installation time.

RottenSys downloads these components silently, using the DOWNLOAD_WITHOUT_NOTIFICATION permission which does not require any user interaction.