Nearly 10 million Android phones have been infected with HummingBad malware

Posted on by

1468431704-7524-en-shot-2016-05-18-at-190725

Nearly 10 million Android phones have been infected with HummingBad malware.

Security companies Checkpoint and Lookout have separately published blog posts about the malware, also known as Shedun, which is said to be making around $300,000 (£232,000) a month for its creators.

“We’ve long been aware of this evolving family of malware and we’re constantly improving our systems that detect it. We actively block installations of infected apps to keep users and their information safe,” said Google in a statement (via BBC News).

The malware generates fake clicks for adverts and is also secretly installing apps and spying on the browsing habits of victims, mainly using phones in China, India, the Philippines and Indonesia.

1468431704-1480-gallery-1463560140-p1280410

“Shedun and the related families follow a particular pattern – they are adware that siltently roots devices, allowing them to remain persistent even if the user performs a factory reset,” wrote Lookout’s Kristy Edwards.

“Shedun also uses its root privileges to install additional apps onto the device, further increasing ad revenues for the authors and defeating uninstall attempts.”

HummingBad/Shedun exploits loopholes in older versions of Android, KitKat and JellyBean.

Last month, Twitter locked millions of accounts following an apparent leak of around 32 million account details.

Meanwhile, earlier this month, Google finally announced that the next version of Android will be called Android Nougat to continue the sweet-themed naming system.