News Summary

• One of the languages programmed into the campaign is English, which means U.S. users are also in range.New campaign automatically installsIf you look carefully, you can see that the messaging uses Unicode characters to trick users into thinking it’s a legitimate Chrome update.
• MoqHao malware is hiding within those downloads with a nasty twist—one which the security researchers describe as a new, “very dangerous technique.”“While the app is installed,” the researchers warn, “their malicious activity starts automatically.
• [But] when a user clicks on the link in the message, it will be redirected to the actual malicious site by the URL shortener service.”Once installed, the fraudulent Chrome update then asks for expansive user permissions, including access to SMS, photos, contacts and even the phone itself.
• As for this one specifically, McAfee warns that “we expect this new variant to be highly impactful because it infects devices simply by being installed without execution.”“Copycat apps are simple to produce,” warns ESET’s Jake Moore.
• You should also never agree to permission requests that aren’t core to an app’s specific functionality.Here are the golden rules for apps and updates:
• There’s no getting around that,” Apple’s Phil Schiller has warned, with malware top of the list of those concerns.Apple opening up to third-party stories will directly contrast its security approach to Google’s, which has always been much less locked down, promoting user choice as a balance to security.