Devious new Android malware uses a Microsoft tool to avoid being spotted

LovabledanielsMarch 26, 202563 Views

McAfee found hackers using .NET MAUI to hide malicious code in Android apps
The apps are being distributed via unofficial app stores and phishing messages
The goal of the malware is to steal data

Cybercriminals are abusing a legitimate Windows tool to create malicious Android applications and steal their sensitive information, experts have claimed.

Security researchers from McAfee showcased two examples caught in the wild, claiming an unknown threat actor was abusing .NET MAUI, a cross-platform development framework to create Android malware capable of evading detection.

“These threats disguise themselves as legitimate apps, targeting users to steal sensitive information,” the report states.

Phishing and fake app stores

There were multiple ways .NET MAUI was used to bypass security protections, McAfee further explained.

For one, the attackers were hiding the dangerous code inside a hidden storage area (blob files) where most antivirus programs don’t usually look.

Then, they used multi-stage dynamic loading (apps were loading small pieces of code one at a time, decrypting them as they go), to make it harder for security software to figure out what was going on.

Furthermore, they added unnecessary settings and permissions in the app’s files to confuse security scanners, and instead of using normal internet requests that security tools can monitor, these fake apps use encrypted messages and direct connections to send stolen data to the hackers.

The malicious apps were not present on any of the reputable app repositories, such as the Google Play Store. Instead, they were found on “unofficial” app stores, to which victims get redirected via phishing links and similar scams.

Among the malicious apps McAfee discovered a fake bank app and a fake SNS app targeting the Chinese-speaking community.

Both apps were tasked with silently stealing data and exfiltrating it to the attacker-owned C2 server.

As usual, the best way to defend against such threats is to only download apps from official repositories, and even then – being careful, reading reviews and other reports.