Security

CopyCat Malware Affects 14 Million Devices

We’re all aware that our mobile devices are at risk of being hacked at any given moment, but when that fear becomes a reality, it can be hard to face. These malicious attacks are serious, and allowing them to take a hold of your device is an unwanted headache that you don’t want to deal with. To negate the possibility of an attack, it’s important to take advantage of DFNDR’s various anti-virus features to protect your device. Click here to use the Full Virus Scan to check your device for hidden malware:

When you take advantage of the Full Virus Scan feature, you can use your smartphone confidently, knowing that you’re well-protected from malware and hackers. You’ll have more privacy and control, as well as a better-performing device — and what could be better than that?

Read More: How Malware Uses Fake Login Screens to Gain Personal Info

The CopyCat Malware
A newly uncovered malware strain, dubbed “CopyCat,” has infected more than 14 million Android users around the world, drawing in approximately $1.5 million in fake advertisements in only two month’s time. This malware has the ability to root infected devices, to establish persistency, and to inject malicious code into Zygote. This is a daemon that is capable of launching apps on Android and allowing hackers full access to the infected devices.

Most of the victims of this malicious attack reside in South and Southeast Asia. However, more than 280,000 Android devices in the U.S. have been affected by this malware. Experts believe that millions were infected with this malware through third-party app downloads as well as phishing attacks. To protect your device from this type of malware, make sure to only download apps from Google Play, and to use our Anti-Hacking feature to protect your device from phishing attempts and malicious websites:

This malware works by disguising itself as a popular and trusted Android app that users choose to download from third-party stores. Once it is added onto a device, the malware begins to collect data from the phone; it then downloads rootkits to root itself within the smartphone, which proves to be the window to more information and power.

After that, the malware removes the device’s security defenses, injects a code into the Zygote app, and launches a process to fraudulently install apps and display fake ads. When these ads are clicked on, they generate revenue. The tricky thing about these ads is that CopyCat abuses the Zygote process and works to display these fake ads while hiding their origins. That means that Android users cannot understand what causes these pop-up ads, meaning that they also don’t know how to stop them.

PSafe Newsroom

The dfndr blog is an informative channel that presents exclusive content on security and privacy in the mobile and business world, with tips to keep users protected. Populated by a select group of expert reporters, the channel has a partnership with dfndr lab's security team. Together they bring you, first-notice news about attacks, scams, internet vulnerabilities, malware and everything affecting cybersecurity.

Recent Posts

How to Free Up Phone Storage Without Deleting Important Photos

The “storage almost full” warning tends to appear at the worst possible time — when…

57 years ago

How to Set Up Find Hub Before You Lose Your Phone

Losing your phone can turn an ordinary day into a race against time. Your device…

57 years ago

RatHat Android malware: how AI and permissions are used

RatHat Android malware drew attention because it uses artificial intelligence during an attack. The more…

57 years ago

Siri AI requirements: supported devices, settings, and privacy controls

The Siri AI beta began rolling out in English on September 14, 2026. Updating to…

57 years ago

What Not to Share With ChatGPT, Gemini, or Any AI

You can ask an AI assistant to summarize a contract, review a document, or explain…

57 years ago

How to See Which Apps Use Your Camera, Microphone, and Location

You open one app to order food, another to edit a photo, and another to…

57 years ago