TangleBot Android Malware Uses COVID-themed Phishing

Android users in the United States and Canada have become the target of a new malware campaign. The criminals behind it use a threat called TangleBot. This is a new piece of Android malware, which packs a long list of features that provide its operators with the ability to control infected devices. In short, the TangleBot Android Malware could be used to hijack device data, personal information, mimic touches and strokes, and even steal accounts for specific services or apps. Needless to say, this turns the TangleBot Android Malware into a very dangerous project, which users should not underestimate. The best way to stay safe is to protect your Android devices with up-to-date anti-malware software.

The criminals are again relying on fake COVID spam to spread the malware. The victims receive an SMS message, which contains a link to a website, which supposedly contains data about the latest COVID-19 regulations in their region. Other variants of the text spam may tell users that they have a vaccine appointment that they should check out in the link. Such messages are not uncommon nowadays, so many people might think that they are legit. However, the link asks users to download and run an Adobe Flash Player update in order to view the content. If the user opts to follow the instructions, they will unknowingly download and run the TangleBot threat on their device.

Fake Adobe Flash Player Update Brings the TangleBot Android Malware

Once it runs, the TangleBot Android Malware demands various permissions from the user – of course, it does this while disguised as an Adobe Flash Player update. It asks for access to files, contacts, camera, microphone, SMS, phone, location, and more. It also requests access to the Android Accessibility Service, one of the most popular traits of modern Android malware.

Once running, the TangleBot Android Malware can do the following:

• Manage phone calls, or block specific numbers.
• Intercept, send, and delete text messages.
• Record the phone's screen or videos using the camera.
• Use the microphone to stream audio to the attacker.
• Display overlay screens on top of apps and websites users would use. This could be used to steal financial data.

The TangleBot Android Malware is still active in the U.S. and Canada, so beware of random messages regarding COVID-19 regulations or vaccine appointments. It is advisable to install an extra layer of security by using an up-to-date Android security product. Read more on how the Ongoing Covid Pandemic Gives Bad Actors New Opportunities.