TheJakartaPost
Please Update your browser
Your browser is out of date, and may not be compatible with our website. A list of the most popular web browsers can be found below.
Just click on the icons to get to the download page.
New Android malware attacks more than 1 million Google accounts: Report
Change text size
Gift Premium Articles
to Anyone
Share the best of The Jakarta Post with friends, family, or colleagues. As a subscriber, you can gift 3 to 5 articles each month that anyone can read—no subscription needed!
Gooligan reportedly infected 13,000 devices each day. (Shutterstock/File)
A
new variant of an Android malware has broken through the security of more than 1 million Google accounts, said Tel Aviv-based software company Check Point Software Technologies on Thursday.
Named Gooligan, the malware is said to have "rooted through Android devices and stolen email addresses and authentication tokens stored on them", allowing attackers to access users' sensitive data on Gmail, Google Photos, Google Docs, Google Play, Google Drive and G Suite.
“This theft of over a million Google account details is very alarming and represents the next stage of cyberattacks,” said the company's mobile products head Michael Shaulov in a press release. “We are seeing a shift in the strategy of hackers, who are now targeting mobile devices in order to obtain the sensitive information that is stored on them.”
(Read also: Live-streaming viewers exposed to malware, data theft: Study)
Gooligan reportedly infected 13,000 devices each day (in which around 40 percent located in Asia and 12 percent in Europe), targeting Android Jelly Bean, KitKat and Lollipop (which means nearly 74 percent of Android devices in use today) and installed at least 30,000 apps on breached devices every day.
The infection is said to begin "when a user downloads and installs a Gooligan-infected app on a vulnerable Android device, or is clicking on malicious links in phishing attack text messages".
Following the news, Google said it had taken action on the matter, which included contacting affected users and revoking their tokens and removing apps associated with the Ghost Push family from Google Play. (fmn/kes)
