Android App Offers Coronavirus Mask, Delivers Trojan
ID: d3ab3890-ec90-5c1c-ba39-4e13f6dba13e
STIX ID: report--d3ab3890-ec90-5c1c-ba39-4e13f6dba13e
Feed Name: Zscaler Security Research Blog
Malicious Android app **Corona Safety Mask** (com.coronasafetymask.app, hash d7d43c0bf6d4828f1545017f34b5b54c) impersonates a COVID-19 safety tool, requests Contacts and SMS permissions, harvests the victim's contacts and automatically sends SMS messages with a download link to propagate itself; dynamic analysis confirmed message delivery and the app opens an online portal. The APK has 0/64 detection on VirusTotal at time of reporting, indicating a likely early-stage, actively spreading campaign that risks further infections, SMS/usage charges, and potential future fraud or data theft.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.