New Android Malware Uses .NET MAUI to Evade Detection

Cybersecurity researchers at McAfee have recognized a brand new wave of Android malware campaigns leveraging .NET MAUI, a cross-platform improvement framework, to evade detection and steal delicate consumer data.

These malicious functions disguise themselves as reputable companies, posing vital dangers to cellular safety.

How .NET MAUI is Being Exploited

Cross-platform improvement frameworks like Flutter and React Native have gained recognition amongst builders for constructing functions that run on each Android and iOS.

Microsoft launched .NET MAUI as a successor to Xamarin, increasing help to Home windows and macOS whereas using .NET 6+ for improved efficiency. 

Based on McAfee, cybercriminals have now tailored by exploiting .NET MAUI’s structure to create malware with core functionalities written totally in C# and saved as binary massive objects (blobs). This methodology permits them to hide malicious code from conventional detection strategies that analyze DEX information or native libraries.

One instance of this malware is a fraudulent banking app impersonating IndusInd Financial institution and focusing on Indian customers. When launched, the app prompts customers to enter private and monetary particulars, together with their identify, cellphone quantity, electronic mail, date of start and banking credentials. This information is then despatched on to the attacker’s command-and-control (C2) server.

Not like typical Android malware, this app lacks dangerous code in its Java or native parts, as an alternative hiding its malicious components inside blob information within the assemblies listing.

One other occasion entails a pretend social networking service (SNS) app aimed toward Chinese language-speaking customers. This malware employs multi-stage dynamic loading, decrypting and executing its payload in three separate levels to make evaluation considerably harder.

Moreover, it manipulates the AndroidManifest.xml file by including extreme, randomly generated permissions to disrupt safety instruments. It additionally makes use of encrypted socket communication over TCP connections to transmit stolen information, making interception more difficult.

Learn extra on Android malware: ToxicPanda Malware Targets Banking Apps on Android Gadgets

Mitigating the Risk

These findings spotlight how cybercriminals are evolving their strategies to bypass typical safety measures.

To scale back the danger of an infection, cellular customers ought to contemplate the next precautions:

• Obtain apps solely from official app shops like Google Play
• Be cautious of functions requesting pointless permissions
• Use safety software program to detect and block potential threats

“To maintain up with the fast evolution of cyber-criminal techniques, customers are strongly suggested to put in safety software program on their gadgets and preserve it updated always,” McAfee added. “Staying vigilant and making certain that safety measures are in place may help defend in opposition to rising threats.”