New Android malware hijacks your front and rear cameras — 7 popular apps it impersonates to trick you

There’s a snarling, vicious malware on the loose that can do unimaginable things to your Android device. CloudSEK, a cybersecurity company, was researching an SMS stealer scam campaign when it stumbled upon a new malware called DogeRAT.

The investigators discovered that DogeRAT targets banking and entertainment industries. And once it’s installed on victims’ phones, it wreaks havoc on the device. Not only can it steal sensitive information (e.g., contacts, banking credentials, and messages), but it can hijack users’ front and rear cameras, too.

What can DogeRAT do?

DogeRAT, as mentioned, is a vicious malware that is capable of causing mayhem on infected devices. You can find the list of its capabilities below:

• Access contacts, messages, notifications and banking credentials
• Send spam messages on user’s behalf
• Make unauthorized payments
• Modify files
• View call logs
• Take photos via the rear and front cameras of affected device
• Capture audio via microphones
• Vibrate target device
• Receive device location
• Spy on installed apps list
• Receive any file or folder from victim’s device

To make matters worse, the creator of DogeRAT offers a premium version, which lets cybercriminals take screenshots, snatch images from victims’ galleries, steal Clipboard information, and work as a keylogger. For the uninitiated, a keylogger lets malicious actors track what you’re typing on your device, allowing them to steal passwords and other personal information.

What’s particularly unnerving is that, according to CloudSEK, malicious actors can use DogeRAT to customize how long they can listen to audio fed from victims’ devices.

Which popular apps does DogeRAT imitate?

Once an unwitting victim downloads a DogeRAT-infected app, they’re prompted to give up several permissions, including access to call logs, audio recording, SMS messages, media, and photos, which is why it can end up causing absolute mayhem on users’ devices.

DogeRAT was caught masquerading as 7 popular apps:

1. Opera Mini – fast web browser

2. Android VulnScan

3. YouTube Premium

4. Netflix Premium

5. ChatGPT

6. Lite 1 [Facebook]

7. Instagram Pro

Luckily, however, you won’t find any of these apps in official Android app stores. “The malware is disguised as a legitimate app and is being distributed through social media and messaging apps,” CloudSEK said.

The investigators said DogeRAT targets users in India, but it still has global reach.

Tips on how to avoid DogeRAT

CloudSEK offered some useful tips on how to avoid getting a DogeRAT infection. Firstly, it’s important to keep your phone up to date with the latest software update, ensuring that any security holes are patched. You’ll also want to stay away from downloading applications from anywhere other than the Google Play Store and other official Android app stores. Yes, the Google Play Store has its troubles, but anywhere outside of it is the Wild Wild West.

Finally, you’ll want to choose a good mobile security solution to keep malware and other security threats at bay (check out our best mobile antivirus apps page).