Chinese Hackers Infect 11,000 Android Devices Globally; Morocco Leads African Targets

Overview of the PlayPraetor Malware Threat

A recent report from a leading cybersecurity firm has uncovered a significant cyber threat involving a Chinese-speaking hacker group. This group has developed a powerful malware named PlayPraetor, which has managed to infect over 11,000 Android devices across the globe within just three months. The scale and speed of this attack have raised alarms among cybersecurity experts worldwide.

Top Targets in Africa and Beyond

Morocco stands out as the most targeted country in Africa, with approximately 22% of all cyberattacks on the continent attributed to this malware. The infection spread is not limited to Africa; Europe has been hit the hardest, with around 58% of the victims located there. Countries such as Portugal, Spain, and France are particularly affected. In the Americas, about 12% of the infections were recorded, while Asia accounts for 8%, with Hong Kong being the most affected region in that part of the world.

Understanding the Malware's Functionality

PlayPraetor operates under the Malware-as-a-Service (MaaS) model, which allows other hackers to use it as a tool for various malicious activities. This includes stealing sensitive data like bank account credentials and cryptocurrency wallet information. Additionally, it enables affiliated hackers to remotely control infected devices, making it a potent platform for fraud.

How the Malware Operates

Experts from Cleafy have detailed how the cybercriminals operate. They disguise their malware as legitimate applications, such as Chrome browsers or banking apps, often mimicking the official Google Play Store interface. Once a user downloads and installs the fake application, PlayPraetor activates and requests Android Accessibility Services permissions. These permissions grant the malware full control over the device.

After gaining permission, the malware connects to the hacker group’s command-and-control (C2) server. This connection allows the malware to perform several malicious actions:

• Collect sensitive data including contacts, SMS, passwords, and screenshots
• Perform overlay attacks by displaying fake login screens on banking apps to harvest credentials
• Execute on-device fraud, mimicking user behavior to carry out transactions or send messages
• Control the device remotely

Expanding Threat Landscape

The report also highlights a shift in the focus of the malware campaign. There has been an increase in targeting users who speak Spanish, especially in Spain and Latin America. Additionally, there is a growing number of French-speaking and Arabic-speaking victims. The emergence of Arabic-speaking victims suggests that the malware campaign may be expanding into new regions.

Cybersecurity Professionals' Warnings

Cybersecurity professionals emphasize that PlayPraetor is rapidly evolving, making it one of the most dangerous threats to the global financial ecosystem. To protect themselves, users are advised to:

• Download apps only from the official Google Play Store
• Exercise caution when granting Accessibility permissions
• Report any unusual login screen changes, especially in banking apps

Conclusion

The widespread impact of PlayPraetor underscores the need for heightened awareness and proactive measures in the face of evolving cyber threats. As the malware continues to adapt and expand its reach, it is crucial for users and organizations to remain vigilant and implement robust security practices. The cybersecurity community must continue to monitor and respond to these threats to safeguard digital assets and personal information.