Ghost Push Android malware infects 1.3m phones per day

[Infantry]

Ghost Push Android malware infects 1.3m phones per day

2015/09/22 21:47:02

Taipei, Sept. 22 (CNA) Cheetah Mobile, a well-known developer of Android apps and utilities, recently released a warning that it has discovered a new malware dubbed "Ghost Push," which infects an estimated 1.3 million Android-based mobile phones globally per day, including many in Taiwan.

The malware is being distributed through non-Google app stores and has managed to infect 14,846 types of phones and 3,658 brands, according to Cheetah Mobile's security research lab.

The most affected users have been identified as residing in countries like the United States, India, China and Mexico, it said.

It was reported that some users in Taiwan have also been affected by the malware.

The company's security researchers claim to have gotten on Ghost Push's trail after they frequently ran into support topics on Android forums asking for help in removing a few uninstallable apps.

Taking a closer look at the apps in question, the researchers found malware hiding in its code that managed to root the victim's phone and install itself in the ROM.

By doing this, the malware became boot-persistent, automatically starting every time the phone was restarted. This meant that countermeasures like starting the device in safe mode or performing a factory reset would not be enough to remove the malware permanently from infected Android phones. The malware slows down the system, drains the battery and consumes large amounts of cellular data, according to the company.

The firm claims that it has detected 40 apps, distributed through unofficial channels, which were bundled with Ghost Push. These apps include MonkeyTest, SmartFolder and TimeService.

The firm claimed that its products Clean Master and CM Security can easily detect the infection.

Cheetah Mobile also said it offers users a remedy to delete this malware in the form of Stubborn Trojan Killer https://play.google.com/store/apps/details?id=com.cleanmaster.security.stubborntrjkiller&hl=en, a special app that is available in the Google Play Store. The app contains descriptive step-by-step instructions on how to delete the malware manually.

(By Esme Jiang and Evelyn Kao)