Daam Malware Warning Issued: Targets Android Smartphones To Steal User Data, Encrypts Devices

A new malware is spreading on Android smartphones, warned the Indian government. Called Daam, the malware can bypass antivirus programs and steal confidential data.

Daam is a multi-faceted and multi-vector malware that is increasingly targeting Android devices. Besides stealing user data and private or sensitive information it can also encrypt devices. Let's look at the capabilities of the Daam malware and the steps to safeguard Android devices.

What Is Daam Malware And How Does It Infect Android Devices?

The Indian cyber security agency CERT-IN has advised against a new malware called Daam. It can not only steal important and confidential data but can also act as ransomware.

Daam malware can reportedly communicate via Android APK files with the intention of infecting the device. Some reports suggest it can even bypass antivirus programs and eventually deploy ransomware on infected devices.

Upon landing on an Android device, the Daam malware attempts to bypass security checks. If successful, it quickly steals all the data stored on the device and attempts to deliver the same to a remote Command-and-Control server.

Some of the capabilities of the Daam malware include reading history, call logs, bookmarks, stealing SMSes, downloading/uploading files, and even modifying device passwords. It can also kill background processes, record calls, capture screenshots, and access the device's camera.

Daam can record routine phone calls and VoIP calls as well. Apart from stealing the information, the newly discovered malware appears to have other intentions as well.

The malware can encrypt files on the device with an AES encryption algorithm. All encrypted files have a ".enc" extension. After deleting locally stored files, the Daam malware drops a ransom note titled "readme_now.txt".

How To Protect Android Devices From Daam Malware?

The Daam malware is going after Android devices primarily because the operating system is quite flexible, claim some security researchers. Incidentally, applications downloaded from untrusted sources and third-party websites are being used to distribute the malware.

Hence, to avoid the Daam malware, keep away from app files or installers from third-party websites. Only install Android apps and games from the Google Play Store or trusted sources.

Update Android OS and install security patches as soon as they are available. Do not click on unknown/untrusted website links shared via SMS/emails/DMs and do not visit such websites.

It is possible the Daam malware may evolve and go after banking apps as it already possesses the capability of looking at SMS. Hence, report any suspicious activity in bank accounts to the respective bank.