Spynote

SpyNote is a malicious software (malware) designed to exploit and damage computer systems, often infecting devices through suspicious downloads, emails, or websites. A newer variant of SpyNote has been observed using the Accessibility API to target well-known cryptocurrency wallets. The malware is distributed via SecuriDropper, disguised as a Google Translate app, allowing it to continuously infect devices, even on Android 13, without needing code modifications. Notably, it has been utilized in attacks against financial institutions to steal sensitive information and has returned with SMS phishing campaigns targeting banking customers. In a campaign discovered by Zscaler's ThreatLabz in December 2023, spoofed Google Meet, Zoom, and Skype websites were used to deploy various remote access trojans (RATs), including SpyNote RAT for Android users and NjRAT and DCRat for Windows users. These RATs can steal confidential information, log keystrokes, and compromise system security. The fake sites provided links to download malicious applications disguised as legitimate ones, such as a phony Skype application which was actually the SpyNote RAT. The distribution domains, including avast-securedownload[.]com and bitdefender-app[.]com, distribute the SpyNote trojan as an Android package file ("Avast.apk") and a ZIP archive file (“setup-win-x86-x64.exe.zip”), respectively. Once installed, these files request intrusive permissions like reading SMS messages and call logs, installing and deleting apps, taking screenshots, tracking location, and mining cryptocurrency. If users clicked on deceptive links on the spoofed Zoom page, they would download a file named "Zoom02.apk" containing the SpyNote RAT, further spreading the malware.