Researchers in cybersecurity have found SecuriDropper, a new sort of Android malware that circumvents Google’s current security restrictions. This Android malware looks to be able to circumvent Android 13’s Restricted Settings security measure by masquerading itself as an app. One such example is com.appd.instll.load.

What exactly is Dropper Malware? Dropper malware for Android is meant to operate as a conduit for a payload to be installed on a compromised smartphone, making it a viable business model for threat actors who may market the capabilities to other criminal groups. Furthermore, doing so allows attackers to decouple the development and execution of an attack from the malware installation.

One security measure introduced by Google with Android 13 is the Restricted Settings, which prevents sideloaded applications from obtaining Accessibility and Notification Listener permissions, which are frequently misused by banking trojans. However, the SecuriDropper aims to prevent detection by avoiding this guardrail.

The unique aspect of SecuriDropper is its implementation of the installation procedure. SecuriDropper, unlike earlier droppers, mimics the mechanism used by marketplaces to install new apps. It makes use of a different Android API to install the new payload without being detected. The dropper sometimes masquerades as innocent software, making it harder for users to detect its malicious intent. 

To keep users secure, Google is continually examining attack strategies and updating Android’s malware defenses.

Join us to jumpstart your cyber career:

error: Content is protected !!
Share This