When Android.Exprespam was discovered earlier this month, we quickly posted a blog warning users about the malware and discussing the details of the attack. Word spread quickly as the media, as well as the local authorities, pushed the news out to a wide audience. It seems like the scammers thought the news had reached enough people and that it was time they updated the malware and the fake market in order to start their attack afresh with new content that people are not familiar with.

The new fake market is called ANDROID EXPRESS’s PLAY (ANDROID EXPRESSのPLAY in Japanese). According to the site, it is maintained by Gcogle.

...

The use of zero-day exploits in attacks has not been too far from the headlines of late. Today, Kafeine from Malware don't need Coffee has released a blog detailing yet another Java zero-day—Oracle Java Runtime Environment Unspecified Remote Code Execution Vulnerability (CVE-2013-0422)—active in the wild and distributed through the Cool Exploit pack. The good news, however, for Symantec customers who use our intrusion prevention signature (IPS) technology, is that Symantec proactively blocked the JAR file containing the exploit from the Cool Exploit Kit with IPS signature...

Contributor: Jeet Morparia
 

As conflict in Syria continues, email attacks against various organizations throughout the Middle East and Europe have also been identified.
 

Figure 1. Sample email used in this campaign from “Free Dom” (Freedom)
 

The targeted organizations are extensive, from individuals at a public university, to hotels, oil companies, and government agencies.

Recipients of these emails are presented with text in Arabic. The email (Figure 1) claims to be an important message from Sheikh Adnan al-Aroor, a figure in opposition to the current Syrian government. The email includes a .zip file attachment, which contains a .lnk (shortcut) file.

In the past, we have...

Contributor: Cathal Mullaney

While the use of erotic images to entice users to infect their computer with malware and security risks is nothing new, Symantec recently discovered three apps that pose a security risk (using this carrot and stick technique) available on Google Play that have accumulated between 500,000 and 1,500,000 downloads between them.

The apps in question, "Porn Sexy Models Wallpaper", "Porn Sexy Girls Live Wallpaper", and "Sexy Girls Ass Live Wallpaper", have since been removed from Google Play.

Figure 1. Screenshot of the security risks on Google Play

After a thorough investigation, we can confirm that all three apps (from the same developer) were not a modified version of a genuine and safe app, but were a risk from the beginning....