Bogus Android Clubhouse App Drops Credential-Swiping Malware

The malicious app spreads the BlackRock malware, which steals credentials from 458 services — including Twitter, WhatsApp, Facebook and Amazon.

Researchers are warning of a fake version of the popular audio chat app Clubhouse, which delivers malware that steals login credentials for more than 450 apps.

Clubhouse has burst on the social media scene over the past few months, gaining hype through its audio-chat rooms where participants can discuss anything from politics to relationships. Despite being invite-only, and only being around for a year, the app is closing in on 13 million downloads. However, as of now the app is only available on Apple’s App Store mobile application marketplace — there’s no Android version yet (though plans are in the works to develop one).

Cybercriminals are swooping in on Android users looking to download Clubhouse by creating their own fake Android version of the app. To add a legitimacy to the scam, the fake app is delivered from a website purporting to be the real Clubhouse website — which “looks like the real deal,” said Lukas Stefanko, researcher with ESET.

“To be frank, it is a well-executed copy of the legitimate Clubhouse website,” said Stefanko on Friday. “However, once the user clicks on ‘Get it on Google Play’, the app will be automatically downloaded onto the user’s device. By contrast, legitimate websites would always redirect the user to Google Play, rather than directly download an Android Package Kit, or APK for short.”

It’s not known how this website is discovered by potential victims, but Stefanko told Threatpost the website is most likely spread via social media or third-party websites like forums. The fraudulent website (joinclubhouse[.]mobi) looks identical to the real Clubhouse website (joinclubhouse.com) — both tell users that they can join with an invite from an existing user, with a call to action: “Sign up to see if you have friends on Clubhouse who can let you in.” While the real website points to users to download the app on the store, the fake site tells users to get the app on Google Play.

However, upon closer inspection the fake website has red flags tipping off potential victims that something is off — such as the connection being HTTP rather than HTTPS, and the fact that the site uses the .mobi top-level domain (rather than the .com used by the legitimate domain).

The Android Malware: BlackRock

If the victim should click on the button that purports to download the app, a trojan called BlackRock is installed on their system. This malware, discovered in July, is a variant of the LokiBot trojan that attacks not just financial and banking apps, but also a massive list of well-known and commonly used brand-name apps on Android devices.

“The trojan — nicknamed “BlackRock” by ThreatFabric and detected by ESET products as Android/TrojanDropper.Agent.HLR — can steal victims’ login data for no fewer than 458 online services,” said researchers.

The targeted list of app credentials includes well-known financial and shopping apps, cryptocurrency exchanges and social media and messaging apps — including Twitter, WhatsApp, Facebook, Amazon, Netflix, Outlook, eBay, Coinbase, Plus500, Cash App, BBVA and Lloyds Bank.

The trojan swipes credentials using an overlay attack — which is a common type of attack for malicious Android apps. In this type of attack, the malware will create a data-stealing overlay of the application that the victim is navigating to, and request the user to log in. However, while the victim believes he is logging in, he is unwittingly handing over his credentials to the cybercriminals.

In a commonly-used tactic by Android malware, the malicious app also asks the victim to enable accessibility services on the phone in order to grant itself permissions on the phone without the victim’s knowledge (Android says that accessibility services are typically used to assist users with disabilities in using Android devices and apps). These permissions give the malware to access contacts, camera, SMS messages and more. This ability to intercept SMS messages is also handy for threat actors looking to get around SMS-based two-factor authentication (2FA) protections set up by the apps on the victims’ phone (if an app sends a 2FA code, for instance, attackers can pick it up via viewing the text messages).

The biggest clue that this app is malicious is that its name is “Install” rather than “Clubhouse,” Stefanko said.

“While this demonstrates that the malware creator was probably too lazy to disguise the downloaded app properly, it could also mean that we may discover even more sophisticated copycats in the future,” he said.

Even as its popularity grows, Clubhouse has come under fire for various privacy issues, such as the fact that conversations via the app are recorded. France’s privacy watchdog also recently opened an investigation into the app over how it protects the privacy of European users’ data.

While this malicious app is in no way affiliated with the legitimate Clubhouse app itself, researchers warn that more sham Clubhouse apps will appear in the future — particularly while the demand for a yet-to-be rolled out Android version continues.

Android users can protect themselves by always sticking to official mobile app marketplaces to download apps to their devices, staying wary of the permissions they grant to applications and keeping their devices up to date (via patching and otherwise).

Originally published at https://threatpost.com on March 19, 2021.