A new Android malware called Herodotus has been discovered, and it has some potentially damaging capabilities. Malware is nothing new to the world of Android or computing devices in general. However, it’s always a little concerning when a new one pops up because you want to make sure your device is safe. Lest you run into a major problem in the future if the malware isn’t caught in time.
In the case of Herodotus, it was discovered by cybersecurity firm ThreatFabric (via Android Authority), which has explained in pretty great detail what this malware can do. The main thing to keep in mind is that it can take over your device, and it mimics human behavior, so the user isn’t aware their phone is infected. Both of these are real issues, but also easily avoidable.
The malware can also grab sensitive data like passwords, intercept SMS messages to see your 2FA codes, and log keystrokes. All of this could lead to many other major problems, including bank transfers or fraudulent purchases.
The Herodotus malware is less likely to affect Android users who are vigilant about security
While there’s no guarantee, it’s always the same for any piece of malicious software that can end up on your mobile device. Users simply need to be vigilant about where they get their apps. In this case, staying within the confines of Google Play means you can avoid installing an app with any known versions of this malware. Google says that Google Play Protect would detect it.
In a statement to Android Authority, the company notes that “Based on our current detection, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”
In other words, if you aren’t sideloading apps, you probably won’t run into this malware. At least when it comes to user-executed app installation. According to ThreatFabric, Herodotus has also taken root through phishing and smishing links. Users should avoid clicking on any suspicious links in this case to further protect themselves from the threat this malware poses.
