This powerful malware has been kept hidden for years, infecting 10,000 smartphones

At the beginning of 2020 BitDefender identified a new, highly sophisticated malware that had been operating in the wild for at least 4 years. This malware is always hidden from users and provides full control of your smartphone to cybercriminals. BitDefender has named the threat "Mandrake Spyware". The main motivation for Mandrake spyware is to take full control of the app.

About the Mandrake Spyware :

Mandrake spyware infringes on the official Android functions to help access everything that is lost in the attack that can collect almost any user information. An attacker can browse and collect all data from the device, stealing account credentials for accounts including bank applications. It secretly captures the recording of the work on the screen, tracking the user's GPS location. Mandrake's efforts have put a great deal of effort into ensuring it remains hidden over the years, until it develops, installs and maintains certain applications in the Google Play Store with the names of various developers. Some of these are also designed to go to specific countries. The apps were very ad-free and the adjustments are routinely presented for users to enjoy. Some apps even have social media pages, all designed to persuade users to download them.


How Mandrake Works :

The malware avoids detection by Google Play by using a multi-stage process to hide a paid load. This malware works in two phases, with the first phase running as a normal app without bad behavior. The app is installed on the phone and communicates with the server to download the appendix, which also provides the additional power required by Mandrake to control the device.

Mitigation :

To help avoid being a victim of such a campaign, users should make sure they trust and know the company that developed the app. Sometimes it might be best to avoid downloading apps from new sources, even if they are in the official download store.