Hackers use fake "COVID-19 tracker" app to invade users' phones and extort Bitcoin

According to BlockBeats, a virus-carrying application called "COVID19 Tracker" has been quietly spreading. Once users install and use this app, their social media accounts will be exposed and all mobile phone storage will be deleted. If users want to avoid this problem, they must pay $100 worth of Bitcoin.

The security research team at DomainTools discovered the spoofed Android app while monitoring recently registered coronavirus and COVID-tagged domains. Normally, when users want to download an Android app, they go to the app store. But when users want to download the "COVID19 Tracker," they find that the app is hosted on the coronavirusapp website. The website describes the app as giving users access to current COVID-19 statistics and the distribution of the disease. Once an unsuspecting victim opens the mobile app, it asks for access to the user's lock screen so that it claims to send the user a notification when a coronavirus patient is lurking nearby. The app also requests "activity monitoring" for the phone's accessibility settings.

In fact, the app was loaded with a ransomware called "CovidLock" in the spring, which uses a technique called "screen lock attack" to force users to change the password used to unlock their phones, thereby cutting off their access to their phones. If users do not pay, the app will display that it will clear the phone's deleted contacts, pictures, and videos. It also claims that it will expose your social media accounts to the world. It even warns: "Your GPS is being monitored, your location is known, and if you try anything stupid, your phone will be automatically deleted."

After CovidLock is activated, the screen changes to a ransom note telling the user to hand over $100 worth of Bitcoin within 48 hours.

Original link: https://decrypt.co/22637/fake-coronavirus-android-app-tries-to-get-ransom-in-bitcoin