Palo Alto Networks

Android

SpyNote Android Trojan Builder Leaked

Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. SpyNote is similar to OmniRat and DroidJack, which are RATs (remote administration tools) that allow malware owners to gain remote administrative control of an Android device.

(more…)...

Malware

Threat Prevention

Unit 42

Jul 28, 2016

By Jacob Soo

Palo Alto Networks

Products and Services

Partners

Cybersecurity, Mobility

Protecting Your Organization Against Mobile Threats

Mobile has been a disruptive force in information technology and it will only continue to grow. The challenge for businesses is that devices must be secured before they can be used within the enterprise setting...

May 05, 2016

By Palo Alto Networks

Financial Services, Malware, Threat Prevention, Unit 42

New Android Trojan “Xbot” Phishes Credit Cards and Bank Accounts, Encrypts ...

We recently discovered 22 Android apps that belong to a new Trojan family we’re calling “Xbot”. This Trojan, which is still under development and regu...

Feb 18, 2016

By Cong Zheng, Claud Xiao and Zhi Xu

Reports, Threat Prevention, Unit 42

Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists

Over the past seven months, Unit 42 has been investigating a series of attacks we attribute to a group we have code named “Scarlet Mimic.” The attacks...

Jan 24, 2016

By Robert Falcone and Jen Miller-Osborn

Malware, Threat Prevention, Unit 42

The Threat Intelligence Research That Mattered to You This Year

Unit 42 did some incredible work in 2015 discovering, analyzing and disclosing malware – some new and others making a reappearance. Take a look below...

Dec 30, 2015

By Anna Lough

Mobility, Threat Prevention, Unit 42

Rootnik Android Trojan Abuses Commercial Rooting Tool and Steals Private In...

We recently analyzed a Trojan named "Rootnik" which uses a customized commercial root tool named “Root Assistant” to gain root access on Android devic...

Dec 04, 2015

By Wenjun Hu, Claud Xiao and Zhi Xu

Application Advisory/Analysis, Malware, Mobility, Threat Advisories - Advisories, Threat Prevention, Unit 42

Chinese Taomike Monetization Library Steals SMS Messages

Mobile app creators are often looking for ways to monetize their software. One of the most common ways to do this is by displaying advertisements to u...

Oct 21, 2015

By Zhi Xu and Claud Xiao

Malware, Threat Prevention, Unit 42

New Android Malware Family Evades Antivirus Detection by Using Popular Ad L...

NOTICE: We have updated this blog to clarify that Airpush is not responsible for Gunpoder. Airpush's platform was abused by the malware author to hide...

Jul 07, 2015

By Cong Zheng and Zhi Xu

Malware, Mobility

Revealing the Secrets: Advances in Android and iOS Attacks

In recent months, Unit 42, the cyber threat intelligence team at Palo Alto Networks, has encountered several game-changing advances in mobile malware for both iOS and Android. For...

May 05, 2015

By Palo Alto Networks

Malware, Mobility, Threat Prevention

Android Installer Hijacking Scanner: Accept No Substitutes!

On March 24, we released the details of a vulnerability impacting millions of Android devices that allows an attacker to modify applications during th...

Apr 10, 2015

By Ryan Olson

Events, News of the Week

Palo Alto Networks News of the Week – March 28

Here’s the top Palo Alto Networks news from this last week.

Mar 28, 2015

By Chad Berndtson

Cybersecurity, Malware, Mobility, Threat Prevention

Two Paths to a Compromised Android Device

Discovered by Unit 42, the Android Installer Hijacking vulnerability exploits a flaw in Android’s “PackageInstaller” system service, allowing attackers to silently gain unlimited permissions in compromised devi...

Mar 26, 2015

By Palo Alto Networks

Malware, Mobility, Threat Advisory/Analysis, Threat Prevention

How Android Installer Hijacking Works

Earlier today we published details of a widespread vulnerability in Google's Android OS that we describe as "Android Installer Hijacking." We have worked with Google and also Samsung and Amazon to patch devices...

Mar 24, 2015

By Palo Alto Networks

Malware, Mobility, Threat Advisory/Analysis, Threat Prevention, Unit 42

Android Installer Hijacking Vulnerability Could Expose Android Users to Mal...

We discovered a widespread vulnerability in Google’s Android OS we are calling “Android Installer Hijacking,” estimated to impact 49.5 percent of all...

Mar 24, 2015

By Zhi Xu

Announcement, Mobility

Announcing GlobalProtect Support for Google Android for Work

Android is one of the most popular mobile computing platforms in the world, and mobile users today have a variety of expectations on what they want to do with their mobile device....

Feb 26, 2015

By Brian Tokuyoshi

Application Advisory/Analysis, Mobility, Threat Advisories - Advisories, Threat Prevention, Unit 42

Scareware App Downloaded Over a Million Times from Google Play

We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection r...

Jan 22, 2015

By Claud Xiao

Events, News of the Week

Palo Alto Networks News of the Week – January 10

Here is the top Palo Alto Networks news from this past week.

Jan 10, 2015

By Palo Alto Networks

Malware, Mobility, Threat Prevention

CVE-2014-7911 – A Deep Dive Analysis of Android System Service Vulnerabilit...

In this post we discuss CVE-2014-7911 and the various techniques that can be used to achieve privilege escalation. We also examine how some of these t...

Jan 06, 2015

By Yaron Lavi and Nadav Markus

Announcement, Malware, Reports, Unit 42

CoolReaper Revealed: A Backdoor in Coolpad Android Devices

Coolpad is the sixth largest manufacturer of smartphones in the world, and the third largest in China. We recently discovered that the software instal...

Dec 17, 2014

By Claud Xiao and Ryan Olson

Application Advisory/Analysis, Cybersecurity, Malware, Threat Advisory/Analysis, Threat Prevention, Unit 42

Bad Certificate Management in Google Play Store

Following a recent study of apps in the Google Play Store, let’s discuss several security risks caused by the bad certificate management practiced in...

Aug 28, 2014

By Zhi Xu and Jen Miller-Osborn

Events, News of the Week

Palo Alto Networks News of the Week – August 22

Here’s a roundup of this week’s top Palo Alto Networks news.

Aug 22, 2014

By Chad Berndtson

Load more blogs