Arid Viper Disguises Android Spyware as Dating-App Updates to Steal Data
Summary
Cisco Talos details an Arid Viper campaign targeting Arabic-speaking Android users with spyware disguised as dating-app updates. The malware can suppress security notifications, steal sensitive data, and install additional malicious apps.
Key points
- The campaign has been active since at least April 2022 and targets Arabic-speaking Android users with links masquerading as dating-app updates.
- The malware impersonates the legitimate Skipped dating app and shares a Firebase project and backend with it; Talos says the overlap suggests the operators may have access to the developers’ project.
- The malware uses attacker-controlled domains and Google Firebase for command-and-control, and can receive updated C2 addresses.
- It can suppress or hide security notifications on devices from Samsung, Huawei, Google, Oppo, and Xiaomi.
- Its capabilities include collecting contacts, call logs, SMS, credentials, device and SIM details, audio recordings, and selected files, as well as making calls and sending SMS.
- The spyware can download and run additional trojanized apps disguised as updates for services including WhatsApp, Messenger, Google Play, and Instagram.
- Talos published malware hashes and network indicators of compromise for defenders.
Article Details
- Attack Vectors
- Arid Viper distributed Android malware through links disguised as dating-app updates, including links shared in Arabic-language tutorial videos.
- The malware used Firebase messaging as C2 infrastructure and could receive additional C2 addresses, download files, and upload collected data.
- The malware could download and run additional APKs disguised as updates for legitimate applications.
- Defensive Notes
- The article recommends using Cisco Secure Endpoint, Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Malware Analytics, Umbrella, Cisco Duo, and Snort Subscriber Rule Set protections to detect or block related activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | conner-margie[.]com | Attacker-controlled domain used in the campaign to host malware or provide C2. |
| DOMAIN | danny-cartwright[.]firm[.]in | Attacker-controlled domain used in the campaign to host malware or provide C2. |
| DOMAIN | haroldramsey[.]icu | Attacker-controlled domain used in the campaign to host malware or provide C2. |
| DOMAIN | junius-cassin[.]com | Attacker-controlled domain used in the campaign to host malware or provide C2. |
| DOMAIN | luis-dubuque[.]in | Attacker-controlled domain used in the campaign to host malware or provide C2. |
| SHA256 | 1b6113f2faf070d078a643d77f09d4ca65410cf944a89530549fc1bebdb88c8c | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | 33ae5c96f8589cc8bcd2f5152ba360ca61f93ef406369966e69428989583a14e | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | 57fb9daf70417c3cbe390ac44979437c33802a049f7ab2d0e9b69f53763028c5 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | 682b58cad9e815196b7d7ccf04ab7383a9bbf1f74e65679e6c708f2219b8692b | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | 8667482470edd4f7d484857fea5b560abe62553f299f25bb652f4c6baf697964 | Hash of an Android malware sample associated with the campaign. |
| SHA256 | 9a7b9edddc3cd450aadc7340454465bd02c8619dda25c1ce8df12a87073e4a1f | Hash of an Arid Viper Android malware sample identified as Skipped_Messenger. |
| SHA256 | a8ca778c5852ae05344ac60b01ad7f43bb21bd8aa709ea1bb03d23bde3146885 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | d5e59be8ad9418bebca786b3a0a681f7e97ea6374f379b0c4352fee1219b3c29 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | d69cf49f703409bc01ff188902d88858a6237a2b4b0124d553a9fc490e8df68a | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | e0e2a101ede6ccc266d2f7b7068b813d65afa4a3f65cb0c19eb73716f67983f7 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | ee7e5bd5254fff480f2b39bfc9dc17ccdad0b208ba59c010add52aee5187ed7f | Hash of an Arid Viper Android malware sample identified as Skipped_Messenger. |
| SHA256 | ee98fd4db0b153832b1d64d4fea1af86aff152758fe6b19d01438bc9940f2516 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | f15a22d2bdfa42d2297bd03c43413b36849f78b55360f2ad013493912b13378a | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | f91e88dadc38e48215c81200920f0ac517da068ef00a75b1b67e3a0cd27a6552 | Malware hash listed in the article’s campaign IOCs. |
| SHA256 | fb9306f6a0cacce21afd67d0887d7254172f61c7390fc06612c2ca9b55d28f80 | Malware hash listed in the article’s campaign IOCs. |
MITRE ATT&CK
T1407The implant could download and run additional APKs disguised as updates for legitimate applications.T1426The malware collected device and system information, including OS, hardware, SIM, battery, and network details.T1429The implant recorded microphone audio, including telephone calls, and uploaded recordings to its C2.T1476The operators distributed Android malware disguised as application updates through links, including links shared in tutorial videos.T1512The malware could access the device camera to take pictures and record video.T1636.002The implant collected call-history information from compromised devices.T1636.003The implant collected contact information from compromised devices.T1636.004The implant collected SMS message contents and metadata from compromised devices.T1646The malware uploaded collected recordings and files to its C2 server.
Threat Actors
Malware
Vendors
Products
AndroidArid Viper disguising mobile spyware as updates for non-malicious Android applicationsFirebasein that it has a similar name and uses the same shared project on the application development platform Firebase. These overlaps, explained in further detail below, suggest the Arid Viper operators may be linked toSkippedused in this campaign shares similarities with a non-malicious online dating application, referred to as Skipped. The malware specifically uses a similar name and the same shared project on the applications’