FlagThis

A malicious Android spyware application, named 'BMI CalculationVsn,' was recently discovered on the Amazon Appstore. The app masqueraded as a simple BMI calculator but was secretly stealing user data. The app, published by ‘PT Visionet Data Internasional,’ appeared to offer a basic body mass index calculation, but it also initiated a screen recording service and scanned devices for installed applications. The app also had the ability to intercept incoming SMS messages, which included one-time passwords and verification codes, and stored this information.

McAfee Labs researchers identified the malicious activity and promptly notified Amazon, leading to the app's removal from the store. However, users who installed 'BMI CalculationVsn' need to manually uninstall it and conduct a full scan of their devices to ensure the spyware is completely removed. The app's activity was traced back to October 2024, with the spyware initially recording screens before it added the BMI calculator interface and SMS interception capabilities. This incident serves as a reminder to exercise caution when downloading apps, even those that appear innocuous.

ImgSrc: securityonline.info

References:

• @bleepingcomputer.com - BleepingComputer - A malicious Android spyware application named 'BMI CalculationVsn' was discovered on the Amazon Appstore, masquerading as a simple health tool but stealing data from infected devices in the background - 2d
• Dataconomy - Fake BMI calculator app on Amazon Appstore steals your data - 2d
• @BleepingComputer - A malicious Android spyware application named 'BMI CalculationVsn' was discovered on the Amazon Appstore, masquerading as a simple health tool but stealing data from infected devices in the background - 2d
• Malware Archives ? Cybersecurity News - Malicious App Found on Amazon Appstore Masquerades as Health Tool - 2d
• Over Security - Cybersecurity news aggregator - Bleeping Computer article on Android spyware on the Amazon Appstore. - 2d

Classification:

• HashTags: AndroidSpyware AmazonAppstore DataTheft
• Company: Amazon
• Target: Amazon Appstore Users
• Product: Amazon Appstore
• Feature: Data Theft
• Type: Malware
• Severity: Major