In this article, we\u2019ll look at four spyware real life examples that were discovered or observed in 2021, including how they invade victims\u2019 devices, what damage they cause, and what techniques we can use to treat and prevent these dangerous infections.<\/p>\n\n\n\n
Spyware Example 1: PhoneSpy<\/h2>\n\n\n\n
On Nov. 10, 2021, researchers at Zimperium zLabs published a report<\/a> about a spyware app they found in South Korea affecting Android devices in the wild. Called PhoneSpy, this malicious program masquerades as a regular application so it can gain access to your infected machine to steal data and remotely control it. This spyware is estimated to have infected more than 1,000 Android devices.<\/p>\n\n\n\n Unknown. PhoneSpy was found in 23 legitimate-seeming apps like Yoga learning, video streaming, and messaging apps. Because these apps are not in the Google Play Store, zLabs researchers believe that the malware was distributed via other third-party platforms that attackers shared via social engineering and phishing techniques.<\/p>\n\n\n\n Not sure what happens when spyware like PhoneSpy gets installed on your device? Here\u2019s a quick overview of what risks are associated with this spyware example and what it can do:<\/p>\n\n\n\n PhoneSpy carries out its activities without leaving a trace and conceals itself by hiding the infected app icon from the device menu. Hence, victims aren\u2019t aware that their device has been compromised. There is no information on how much data is stolen or how they are misused.<\/p>\n\n\n\n On Nov. 22, 2021, Zimperium posted that PhoneSpy\u2019s command and control server had been taken down and is no longer active. So, in theory, PhoneSpy should no longer be a threat. It\u2019s possible that this spyware example was used for espionage and the campaign ended when the mission was completed. Nevertheless, you should avoid installing apps from anywhere other than official app stores (Google Play, Apple App Store, etc.) and exercise caution if anyone asks you to do so.<\/p>\n\n\n\n Advanced persistent threats (APT) are well-planned, well-organized, multi-staged attacks. They usually target government agencies and corporate giants and are operated by groups of hackers working together. As espionage is one of the main goals for APT attacks, hackers often use innovative spyware to deploy them.<\/p>\n\n\n\n One infamous APT group is ATP-C-23. ATP-C-23 use many types of attack, including Android\/SpyC23. On Nov. 23, 2021, Sophos published a report<\/a> stating that they\u2019d discovered a new, powerful variant of spyware called Android\/SpyC23.A. The malicious program is used by an infamous threat actor group known as ATP-C-23. Previous versions of this malware are known as VAMP<\/a>, FrozenCell<\/a>, and GnatSpy<\/a>.<\/p>\n\n\n\n Once installed onto the target device via a compromised app, the spyware tricks the user into granting admin permission to the hackers. This access allows the attacker to:<\/p>\n\n\n\n The new variant has the power to connect to other C&C servers in case the main server is taken down. It also hides notifications coming from security apps and the Android system, which means the victim isn\u2019t alerted of the threat \u2014 even if their mobile has already detected the malware.<\/p>\n\n\n\n Android\/SpyC23.A is delivered through infected apps and distributed via SMS or similar mediums. It may be disguised as:<\/p>\n\n\n\n After infecting a device, Android\/SpyC23.A changes its display icon and name to another well-known app to disguise itself. Sophos reports that some examples of the apps this spyware commonly impersonates include:<\/p>\n\n\n\n Now that we know what Android\/SpyC23.A is and how it infects your device, it\u2019s time to explore its effects:<\/p>\n\n\n\n Only download apps from the App Store or Play store, never from SMS, WhatsApp, or emails. Don\u2019t give admin permissions\/superuser\/root access to any apps. We haven\u2019t found any antispyware program claiming yet that they can remove Android\/SpyC23.A, so the best way to mitigate the threat is to avoid infection.<\/p>\n\n\n\n It\u2019s safe to say that Israel-based NSO Group\u2019s Pegasus spyware<\/a> disrupted the world of espionage, making headlines all over the world. Although the company claims that it helps nations fight terrorism and crime, evidence suggests that people are using Pegasus software for their personal agendas. It is used to spy on activists, political rivals, workers, bloggers, media employees \u2212 anyone the client wants.<\/p>\n\n\n\n The latest attack, FORCEDENTRY affects targeted Apple users. On Sept. 13, 2021, a scientist at Citizen Lab published a report<\/a> about a zero-click exploit that exploits a vulnerability in iOS\u2019s CoreGraphics to deliver Pegasus spyware. Along with spying on the victim\u2019s devices, it was deleting the pieces of evidence from the phone\u2019s DataUsage.sqlite file, too.<\/p>\n\n\n\n NSO Group has clients in many countries, including the United States, United Kingdom, Saudi Arabia, United Arab Emirates, Hungary, France, and India. You can see all the latest developments related to Pegasus Spyware on The Guardian<\/a>\u2019s website.<\/a><\/p>\n\n\n\n Pegasus spyware is distributed via three main methods:<\/p>\n\n\n\n After infecting a device, Pegasus can:<\/p>\n\n\n\n Pegasus spyware is used to spy on targeted users and is not currently a threat to most of us. If you think you could be a target of Pegasus spyware, it\u2019s best to get help from a trusted cybersecurity expert. Because this spyware is used in highly sophisticated attacks, you won\u2019t be able to prevent it due to the vulnerabilities that exist on your phone.<\/p>\n\n\n\n However, to avoid infection, be vigilant when opening unknown videos, messages, or links. If you think your device is infected, you can always perform a factory reset to get rid of many types of malware<\/a>.<\/p>\n\n\n\n Ghost RAT (also written as Gh0st RAT) is a trojan horse made for spying. RAT stands for \u201cremote administration tool.\u201d This name is appropriate considering that Ghost RAT\u2019s operators, GhostNet System, use a C&C server to control victims\u2019 devices remotely.<\/p>\n\n\n\n The latest Ghost RAT attack was on NoxPlayer, a free Android game emulator for PC and Mac from a company named BigNox. On Feb. 1, 2021, WeLiveSecurity<\/a> published a report indicating that attackers breached BigNox\u2019s API infrastructure to host and deliver Ghost RAT and other two types of malware. It targeted users from Taiwan, Hong Kong, and Sri Lanka.<\/p>\n\n\n\n Attackers use phishing and social engineering scams to trick potential victims into downloading the infected software. Because Ghost RAT is a trojan, the payload doesn\u2019t work until users download, install, and activate the software.<\/p>\n\n\n\n After a user installs Gh0st RAT, the spyware\u2019s author (i.e., the hacker) can:<\/p>\n\n\n\n The basic steps for protecting your device against Gh0st RAT spyware are the same as with any other malware:<\/p>\n\n\n\n Legitimate companies use code signing certificates<\/a> to validate the authenticity of their software. Organizations that request these publicly trusted digital certificates must first be vetted by a third-party certificate authority (CA). The CA verifies specific types of information about your organization prior to issuing the certificate. This offers a level of trust and validity to both your organization and software by attaching your verified organization information to your software.<\/p>\n\n\n\n But how do you know whether an application is digitally signed? A dialogue box will appear that displays your verified organization\u2019s name in the publisher\u2019s field when a user downloads or tries to install your software.<\/p>\n\n\n\n Compare this to an example of the \u201cunknown publisher\u201d message that displays when a user attempts to install unsigned software:<\/p>\n\n\n\n Code signing certificates come in two varieties: standard validation<\/a> and extended validation<\/a>. What\u2019s the difference between the two?<\/p>\n\n\n\n There\u2019s a misconception that only influencers and politically active people can become the target of spyware. But spyware operators have many other goals besides espionage, and virtually no one is a potential target. Cybercriminals can use spyware to use as blackmail after stealing your sensitive data. They also can sell the data they gain to advertisers who want to gain a better understanding of your likes, interests, and buying preferences.<\/p>\n\n\n\n To avoid spyware infections, always be vigilant in your downloads and when clicking links or and granting app permissions. Don\u2019t hesitate to take experts\u2019 help if you think your device is infected with spyware. We hope these latest spyware examples provided you with an idea of how the spyware situation was in 2021, and what you can do to protect yourself and your data in 2022.<\/p>\n","protected":false},"excerpt":{"rendered":" Not sure how spyware works or what damage it can cause? Want to get up to date with the latest spyware examples and industry trends? Let\u2019s explore several of the…<\/p>\n","protected":false},"author":6,"featured_media":2795,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13],"tags":[22,226],"class_list":["post-2791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","tag-malware","tag-spyware-examples","post-with-tags"],"yoast_head":"\nHow PhoneSpy Infects Your Device<\/h3>\n\n\n\n
![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/01\/spyware-examples-phonespy-zimperium-zlabs.png\")
What Happens When PhoneSpy Infects Your Device<\/h3>\n\n\n\n
How to Protect Your Device Against This Spyware Example<\/h3>\n\n\n\n
Spyware Example 2: Android\/SpyC23.A<\/h2>\n\n\n\n
How Android\/SpyC23.A Infects Your Device<\/h3>\n\n\n\n
What Happens When Your Device Becomes Infected?<\/h3>\n\n\n\n
How to Protect Your Device Against This Spyware Example<\/h3>\n\n\n\n
Spyware Example 3: Pegasus<\/h2>\n\n\n\n
How Pegasus Spyware Infects Your Device<\/h3>\n\n\n\n
What Happens When Pegasus Gets Onto Your Phone<\/h3>\n\n\n\n
How to Protect Your Device Against This Spyware Example<\/h3>\n\n\n\n
Spyware Example 4: Ghost RAT<\/h2>\n\n\n\n
How Ghost RAT Infects Your Device<\/h3>\n\n\n\n
What Happens When Ghost RAT Gets Installed<\/h3>\n\n\n\n
How to Protect Your Device Against This Spyware Example<\/h3>\n\n\n\n
How to Recognize Legitimate Software to Avoid Spyware (and Other Types of Malware)<\/h2>\n\n\n\n
![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2022\/01\/windows-defender-smartscreen-unknown-publisher-example.png\")
<\/figure>\n\n\n\nFinal Words on Spyware Examples in 2021 and What This Means for 2022<\/h2>\n\n\n\n