ESET discovers open-source espionage tool called AhMyth

In News, Research

ESET researchers have discovered the first known instances of spyware based on the open-source espionage tool called AhMyth. This particular spyware was posing as an internet radio app playing very specific Balochi music; however, the spying capabilities may be easily attached to any other app.

AhMyth, from which the internet radio app borrowed its malicious functionality, was made publicly available in late 2017. Since then, various malicious apps based on AhMyth have appeared. However, the above-mentioned app, named Radio Balouch, is the very first of them to make it onto the official Android app store, Google Play.

ESET Mobile Security for Android has protected against AhMyth and its derivatives since January 2017, even before AhMyth went public. “The malicious functionality in AhMyth is not hidden, protected, or obfuscated. For this reason, it is trivial to identify the Radio Balouch app – and other derivatives – as malicious and classify them as belonging to the AhMyth family,” comments Lukáš Štefanko, malware researcher at ESET who conducted the investigation.

Lukas Stefanko, Malware Researcher at ESET

After ESET reported the discovery to Google, its security team removed the malicious Radio Balouch app from the store. The attackers, however, were quick to make the app reappear on Google Play. “We also detected and reported the second instance of this malware, which was then swiftly removed. However, the fact that the same developer was able to post this evident malware to the store repeatedly is disturbing,” says Štefanko.

Radio Balouch, detected by ESET as Android/Spy.Agent.AOX, has been promoted on a dedicated website, Instagram, and YouTube. After having been removed from Google Play, it is now only available on alternative app stores.

This app is a fully functional internet radio application for music specific to the Balochi region. In the background, however, it spies on its users: it can steal contacts and harvest files stored on the affected device. “The open-source AhMyth espionage tool has a number of variants whose functionalities vary. The Radio Balouch app – and any other AhMyth-based malware, may receive further functions in the future,” warns Štefanko.

According to ESET researchers, the repeated appearance of the malicious Radio Balouch app on the Google Play store should serve as a wake-up call to both the Google security team and Android users. “Unless Google improves its safeguarding capabilities, a new clone of Radio Balouch or any other derivative of AhMyth could again appear on Google Play,” comments Štefanko. “The key security imperative – to stick with official sources of apps- still holds; however, that alone can’t guarantee security. We highly recommend users scrutinize every app they intend to install on their device and use a reputable mobile security solution,” concludes ESET’s Štefanko.


You may also read!

Infoblox unveils the Big Switch Off challenge

Infoblox, the leader in cloud-first DNS management and security, announces The Infoblox Big Switch Off Challenge, as a part


Veeam educates organizations on accelerating Modern Data Protection strategies during VeeamON Tour in Dubai 2021

Veeam Software, the leader in backup, recovery, and data management solutions that deliver Modern Data Protection, hosted 175+ registered


Cyber attacks – hackers are getting faster and more sophisticated

In this exclusive opinion piece, Roland Daccache, Systems Engineer Manager MEA, CrowdStrike, writes on the trends of cybercrimes.  The


Join Our Newsletter!

Love SecurityMEA? We love to tell you about our new stuff. Subscribe to newsletter!

Mobile Sliding Menu