Scammers try to get Android users to install a fake Clubhouse app, full of malware

Clubhouse is an audio-based social app that has attracted major headlines and venture capital rounds, but the service is still only available for Apple Inc. iOS devices. Android users have been keen to check out the service, however, which is exactly what some scammers are taking advantage of with fake Clubhouse Android apps.

A fake Android Clubhouse discovered recently last week by researchers at ESET spol sro was discovered to contain a malicious package aimed at login information steal users from various online services. The Clubhouse cheat app for Android includes a Trojan virus called “BlackRock” and can steal data from at least 458 online services.

Targeted services include financial and purchasing apps, cryptocurrency exchanges, social media services and messaging platforms. Specific targets include Twitter Inc., WhatsApp, Facebook Inc., Amazon.com Inc., Netflix Inc., Microsoft Corp. Outlook, eBay Inc., Coinbase Inc. and Cash App.

The app is distributed through a deceptive website which has been described as looking like the “real deal” and a well-executed copy of the legitimate Clubhouse website. Unlike official circulation, the site encourages visitors to download the app directly instead through Google Play.

The ability to steal account details is bad enough, but the BlackRock Trojan can also send text messages. This means that even users would use two-factor authentication to prevent anyone from having their accounts exposed to account theft as well.

“One of the problems with creating unique online experiences is that they’re becoming popular and everyone wants to join in,” said Tim Mackey, chief presenter. security strategy at Synopsys Inc. Cybersecurity Research Center, with SiliconANGLE. “When the online experience comes from a specific app and there is no version for both Apple and Android operating systems, such a gap is an attractive target for criminals to take advantage of.”

Chris Clements, vice president of solutions architecture at information technology service management company Cerberus Cyber ​​Sentinel Corp., noted that cybercriminals take advantage of any opportunity to expose their victims. risk and the launch of a popular new app that is not yet available on major platforms like Android are on display. with prime opportunity.

“The BlackRock trojan is one of the biggest pieces of mobile malware – it’s almost easier to list the accounts it doesn’t steal,” Clements said. “Coupled with almost complete control of the mobile device if they receive Access Service benefits, this can be devastating for victims who have their phones as the main computing device in their life.”

The final solution here is to prevent scammers and malware operators from targeting Android users to offer the Clubhouse Android app. That app may be off sometime, though, with Clubhouse hiring Android software developer February 22nd.

Clubhouse suffered a security breach in February when a third-party developer designed an open source app that allowed Android users to access Clubhouse, even though there was no malware.

Image: Clubhouse