Mobile users have had their fair share of malicious infiltration over the years. Unfortunately, such practices are on the rise in 2022 as cybercriminals keep finding new ways to target victims – one of these ways is the official app store itself. We’ve seen it before, and we’re seeing it again – Scylla has infiltrated the App Store.
Researchers dubbed the attack Scylla – a new wave of malicious activity involving the use of malicious applications against iOS and Android users. What’s worse is that these apps boast millions of downloads – 13M to be exact.
How many applications have been compromised? What did Google and Apple do about it? We’ve discussed the entire incident in the following article.
Scylla – From Mythology to Cybersecurity
This is not the first time cybercriminals target Android and iOS native app stores. In fact, the Google Play Store alone witnessed more than a dozen attempts in 2022 only.
Now, it’s quite big as the campaign has around 75 apps on Google Play and 10 on Apple App Store. These apps have been engaging in ad fraud, we’ll talk about that in a bit.
What’s alarming though is that the campaign has been around since 2019, which makes us ourselves: Can iOS and Android security measures be trusted?
The 80+ malicious apps can perform all sorts of activities such as installing hidden apps, spoofing, and fake clicks. Scylla is dangerous and we know that as the attackers managed to find a way to target iOS devices too.
Online fraud-prevention firm HUMAN Security discovered the attack and stated that similar ones happened in previous years.
What’s odd is that they occurred in August 2019 and late 2020 and went by the codename Poseidon and Charybdis, respectively.
These two are part of Greek Mythology and so is Scylla. If you’re not familiar with Scylla and Charybdis, it refers to “to choose the lesser of two evils.”
Fortunately, none of the evils remain as the applications have been removed from either app store. However, before the removal from the app storefronts, the apps were collectively installed more than 13 million times.
In other words, whoever has these applications should uninstall them immediately and run a virus check for their devices. Make sure to use a reputable service.
Constant Targets – iOS & Android in the Spotlight, Again!
Among the 3 campaigns, Scylla was the most dangerous as it was able to hit iOS with 9 apps. As we mentioned, the apps can do a lot, including spoofing popular apps such as streaming services to trick advertising SDKs into placing ads.
Not only that, but they can also generate fraudulent ad clicks to profit off ads. If you have any of the apps, uninstall them.
