The Top Five Mobile Malware Threats in June

Xavier
An Android trojan malware that steals and leaks user information, it has been found within over 800 applications on the Google Play Store which have been downloaded millions of times.

Judy
An auto-clicking malware that uses infected devices to produce fraudulent clicks on ads, generating cash for hackers, there are between 4.5 and 18.5 million infected app downloads from the Google Play store.

Ztorg
A trojan SMS malware variant that can send premium rate SMS messages and open ad URLs to siphon users’ money, two apps identified as hosting the malware have been downloaded over 20,000 times from the Google Play Store.

Dvmap
A new rooting malware and the first Android malware ever to inject malicious code into the device’s system runtime library to gain root privileges. It has been downloaded more than 50,000 times.

Marcher
A sophisticated banking malware that steals users’ financial information which waits in the background for an app to open from a targeted list of banking domains and overlays a fake login page to lure the victim into supplying credentials. Worryingly, less than 20% of antivirus scanners have been able to detect it.

Mobile data leaks continue through June

Location & Email
Location leaks took the lead this month over email address leaks, demonstrating the frightening number of developers leaving users’ sensitive information unprotected. The number of sites and apps tracking users’ locations has increased substantially over the last few years.

Username & Password
Username and password leaks stayed relatively constant this month, except for a large peak in volume at the beginning of June, this was due to two events occurring within the customer base. The first was the result of an employee using an online radio application that leaked his username in plaintext over 5,000 separate times in one day. The second occurred when an employee logged into the hosting website for a security camera feed. This website leaked the user’s password by sending it unencrypted over the internet more than 2,000 times.