In the security world where Trojans remake themselves more often than a fading Hollywood actor, the Marcher Trojan is no exception. The 3-year-old Marcher has found new relevance targeting Android users visiting porn sites, according to a report from security firm Zscaler.
Over the past month, researchers observed a new Marcher campaign where attackers are attempting to place malware on Android devices by prompting porn surfers to install a malware-infected payload identified as an Adobe Flash Installer Package.
“We have captured over 50 unique payloads from this campaign,” wrote
Zscaler in a bulletin posted Thursday. Zscaler told Threatpost it has also documented instances of Marcher malware pushed through popcash[.]net ad network redirects.
Marcher has evolved into a sophisticated Android malware that is fully aware of user device’s application profile, Zscaler said. “This is the first wave where we have seen Marcher variants leveraging a combination of porn lure and [a phony] Adobe Flash Player update,” it added.
