Beware! Fake Google Play Store Sites Used to Spread Android Malware

Cybersecurity researchers have identified a resurgence of SpyNote malware campaigns targeting Android users via sophisticated fake Google Play Store websites that mimic legitimate app installation interfaces. The threat actor behind these attacks uses new anti-analysis techniques and a multi-stage infection process designed to evade detection, with the initial dropper APK containing encrypted assets and a 16-byte AES decryption key derived from the app’s manifest package name.

When users click Install, JavaScript on the fake pages automatically triggers the download of malicious APKs from the fraudulent sites, and recent samples employ DEX Element Injection to modify Android’s ClassLoader at runtime, hijacking app behaviour.

According to the report, SpyNote is a comprehensive Remote Access Trojan capable of remotely controlling device cameras and microphones, managing calls, and performing keylogging while abusing Android’s Accessibility Services to steal two-factor authentication codes, with overlay attacks to capture credentials. IoCs identify the delivery infrastructure around IPs such as 154.90.58[.]26 and 199.247.6[.]61 and domains including mcspa[.]top and pyfcf[.]top, plus associated Chrome and CamSoda APKs.

The campaign’s persistence, evasive techniques, and extensive surveillance capabilities underscore ongoing risks to mobile users and the need for strengthened site detection and analysis.