Specialists from Kaspersky Lab discovered two new malicious programs for Android, called Cookiethief and Youzicheng, capable of stealing cookies stored in the browser on smartphones and in applications of popular social networks, in particular Facebook. Thus, criminals can discreetly take control of a victim’s account on a social network and distribute content on her behalf.
Attackers developed two malware with a similar coding style and using the same C&C server. Once on the device, the Cookiethief Trojan receives superuser rights and transfers the cookie files of the browser and the installed social network application to the C&C server.
But just the session identifier is not enough to seize control over someone else’s account. For example, the security systems of some websites prevent suspicious login attempts on the system. For such cases, the criminals created a second malware – Youzicheng. It can launch a proxy server on the phone and provide cybercriminals with access to the Internet from the victim’s device to bypass security measures.
As experts noted, malware does not exploit vulnerabilities in a mobile browser or social network application, and attackers can steal cookies from any site.
“By combining the two types of attacks, attackers found a way to gain control over user accounts without causing suspicion. This is a relatively new threat, as long as no more than a thousand people have been exposed to it. This number is growing and, most likely, will continue to grow, given that it is difficult for web sites to detect such attacks, ”the experts explained.