Among the many requested permissions are Accessibility Companies, display screen recording, display screen casting, and overlay show rights. Collectively, these give the malware in depth visibility into consumer interplay and the flexibility to seize on-screen content material throughout apps.
The researchers stated these capabilities can be utilized to observe and report consumer exercise in actual time, show pretend authentication interfaces mimicking fashionable monetary platforms (like Alipay and WeChat) to reap credentials, seize lock display screen patterns and biometric inputs, and exfiltrate harvested information again to an actor-controlled command and management (C2) server.
Bitdefender stated it contacted Hugging Face earlier than publishing the disclosure, and the latter shortly took down the datasets containing malware. Hugging Face didn’t instantly reply to CSO’s request for feedback.
For added assist, Bitdefender has shared a listing of indicators of compromise (IoCs), together with dropper hashes, IPs, domains, and bundle names.
