Fraudulent Black Friday Apps Spread Malware

Security researchers discovered more than 32,000 fraudulent Black Friday apps in the wild, many of which use the branding of the top five U.S. online retailers to spread malware and steal customer credentials.

According to RiskIQ’s “2017 Black Friday E-Commerce Blacklist,” which was derived from a data set of 2 billion daily HTTP requests, 20 million mobile apps, 300 million domain records and 783 locations across more than 100 countries, about 1 in 25 Black Friday apps available in global app stores are malicious. Researchers also discovered at least 15 fraudulent apps that use the branding of the top five online retail companies to dupe users into divulging their sensitive data.

App Store Security Is Not Bulletproof

Black Friday is a huge day for e-commerce. According to the RiskIQ report, in 2016 154 million consumers did their Black Friday shopping online, spending $5.27 billion, which represented a 17.7 percent increase year over year. Mobile revenue alone totaled $1.2 billion, representing a growth rate of 33 percent year over year. Overall, nearly 40 percent of sales occurred on a mobile device during last year’s Black Friday weekend.

The report found that even some of the most popular app stores featured malicious Black Friday apps. The Google Play store hosted the largest number of fraudulent apps, while Apple’s App Store contained 85 legitimate apps that had been infected with malware despite rigorous security testing. The report pointed out that although most official mobile app stores have relatively strong verification processes in place, these systems are “not bulletproof.”

While the volume of blacklisted apps declined by 40 percent from Q1 to Q2 2017, suggesting a global boost in security awareness, these apps still put less savvy online shoppers and retailers at risk of fraud during the holiday shopping season.

Avoiding Fishy Black Friday Apps

To mitigate the risks from these malicious apps, RiskIQ advised users to avoid downloading applications that request questionable permissions to access data such as contact lists, text messages, administrative features, stored passwords and credit card information. Users should also be wary of app developers who use free email services such as Gmail.

The most obvious and important takeaway from the report is that consumers must be particularly proactive about their online security during the bustling holiday season.

Larry Loeb

Principal, PBC Enterprises

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

App Store Security Is Not Bulletproof

Avoiding Fishy Black Friday Apps

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates