Alert: Largest Recorded Breach of Android Nets Hackers a Big Pay Day

A previously known malware called Ghost Push now has a component that has caused countless problems for over a million Android users. This component, called Gooligan, is the source of the trouble, and it adds to this chaos by infecting over 13,000 new devices every day.

Gooligan can steal the authentication tokens that are used to access information stored by Google’s most common offerings. Among these are Google Drive, Google Docs, Gmail, and the G-Suite.

Rather than using the vulnerability to steal data, the criminals seem content with just using the devices to install malicious apps from the Google Play store to generate ad revenue. In fact, according to reports, this primary reason to use Gooligan brings in about $320,000 every month for the fraudsters, which makes Gooligan perhaps the largest Android breach in its history.

Of course, we bet that you’re breathing in a sigh of relief, thanking your lucky stars that Gooligan hasn’t shown any signs of stealing data. When you think about it, this is pretty incredible, as Gooligan could potentially be accessing sensitive information that is stored anywhere on your Android device. Even Google believes that Gooligan is focused more on accruing revenue rather than stealing data, claiming “The motivation… is to promote apps, not steal information.”

Google has taken the initiative and removed apps that include Gooligan from the Play Store, but who knows what other threats are out there, just waiting to be installed on a device? Keeping these threats in mind is key, especially when you have employees using their own mobile devices to access company data. If your employees access the Play Store on their devices, you need to educate them on the effects of Gooligan and how to avoid becoming a victim.

This is why it’s so important that your organization is ready to handle employee devices by following a strong Bring Your Own Device policy. If you don’t already have a BYOD policy in place, be sure to implement one as soon as possible--one that requires any employees using their own devices for work purposes to go through IT and ensure that security protocol is followed closely.

If you don’t already have a plan to deal with unauthorized devices on your network, or unauthorized apps appearing on your devices, be sure to reach out to us at (703) 821-8200.