Malware Disguised as Government’s mParivahan App Exposed

Seqrite, the enterprise security arm of Quick Heal Technologies Limited, have discovered a dangerous new variant of malware which is disguising itself as the Indian government’s official “Nextgen mParivahan” application. This malware was found during one of Seqrite’s threat-hunting operations.

It was revealed that the malware uses various evasion methods to steal sensitive user data from apps such as WhatsApp, Amazon and Gmail. Since people generally trust government-run apps, this government app-disguised malware misuses that same trust factor to coax users into installing further malicious applications. The malware avoids detection via malformed APK (Android Package Kit) files and has the ability to remain functional on devices running Android 9 or above. Several variants of this malware have been found, all of which use sophisticated techniques and deployment processes to extract user data.

Seqrite recommends that Android users be extra cautious while downloading new applications, especially those from unknown sources. They also recommend cross-referencing any unexpected traffic violation notifications with the official Ministry of Road Transport and Highways’ website to confirm the legitimacy of the notification as well as the mParivahan app itself.

With viruses, trojans, and malware in general getting more sophisticated day-by-day, everyone should exercise caution while using their connected devices. Installing an antivirus software can also help.