Now Data-Stealing Marcher Android Malware is Posing as Security Update

Cybercriminals are telling users their device is at risk from viruses unless they download a particular ‘security update’ — which delivers the malware.

The notorious Marcher malware is now disguising itself as an Android firmware update, in another demonstration of how cybercriminal tactics are constantly evolving in order to dupe unsuspecting users into installing malicious software.

The Marcher malware has been around since March 2013, and was previously distributed through fake Amazon and Google Play store apps. Once Marcher is installed on an Android device — it hasn’t appeared on any other operating system — cybercriminals send the victim an alert to log-in to their banking apps, allowing the crooks to make off with the stolen information.

Now cybersecurity researchers at Zscaler have discovered the latest dirty trick in Marcher’s arsenal: posing as an Android firmware update.

The malware is initially served up by displaying a fake alert on a compromised HTML page, ironically warning the user that their device is vulnerable to computer viruses and data theft, encouraging them to install ‘Firmware_Update.apk’, a fake security update which will infect the Android device with Marcher.

Once installed, Marcher will ask for administrative access to the infected Android system, allowing the cybercriminals behind it to monitor the device and steal login data of not just banking and payment apps, but also for apps including Facebook, Facebook Messenger, WhatsApp, Instagram, Chrome, Skype, Gmail, the Google Play store, and more.

Marcher will implement checks for each of these well known apps and show a fake login page if any of the apps are opened.

Zscaler has labelled Marcher “the most prevalent threat to the Android devices” due to the constantly evolving nature of the malware. The best way for Android users to avoid falling victim to Marcher is to only download applications from trusted application stores such as Google Play, and not downloading anything from unknown sources.

Malware is a growing problem for Android users and Marcher isn’t even the only form of it discovered by Zscaler. In April, the security firm’s researchers spotted banking and personal information stealing mobile malware posing as a Google Chrome update for Android. It can’t be removed from the infected device.