FakeSpy Android Malware Targets Legitimate Postal snd Transportation Services

Key findings

• In this new campaign, FakeSpy malware was masquerading as legitimate government post office apps (like Chunghwa Post, The Royal Mail, US Postal Service, Deutsche Post, Japan Post, Swiss Post) and transportation services apps (like Yamato Transport) to gain the users' trust.
• The FakeSpy malware was using smishing (SMS phishing) messages to lure the victims to click on a malicious link to infiltrate target devices. The link directed them to a fake website that prompted them to download and install the FakeSpy APK.
• FakeSpy has multiple built-in information-stealing capabilities. The newer version of FakeSpy uses new URL addresses for malicious communication and multiple techniques to evade detection via the emulator.
• The campaign has a connection with the Chinese threat actor dubbed "Roaming Mantis".

Roaming Mantis group's recent activities

• In June, the RoamingMantis cybercrime group employed phishing attacks against Apple ID accounts and Android accounts and started targeting new regions via phishing website lures.
• In February, the Roaming Mantis campaign delivered Fakecop (aka SpyAgent) and Wroba.j (aka) Trojans via SMS spam, containing links to a variety of fake websites. The group also spoofed customized brand icons.

Stay safe