Monokle

Monokle is a sophisticated malicious application that is used to spy on particular users only. It means that instead of being spread widely, the threat is distributed only among those who may have information or access to data that the hackers behind this malware may want. According to cyber security experts, the malicious application comes from Russian developers who provided tools that interfered with the 2016 US presidential elections. However, specialists describe Monokle as something they have never seen before. That has to do with its capabilities as it appears the malware might do much worse than spy on a victim or steal sensitive information. Further, in this article, we discuss the malicious application’s capabilities as well as its distribution. Thus, if you want to learn more about this vicious threat, we invite you to read our full article. Also, if you have any questions, we can offer our comments section available at the end of this page.

It seems victims who are targeted with Monokle might be tricked into installing it and might not realize what has happened even after the malicious application is settled. That is because the threat seems to be spread with infected versions of programs that look like legit Android applications or other tools. For example, during one of the discovered campaigns, cybercriminals attacked users from the Caucasus region and those interested in the Ahrar al-Sham militant group in Syria. For this task, hackers picked legit applications like UzbekChat and Ahrar Maps. To make sure that only targeted groups of people downloaded legit apps infected with Monokle, the cybercriminals behind the malware were distributing them among specific websites that they knew were often visited by their targeted users. Another thing that was noticed about the applications carrying the malware is that their titles are mostly written in English, Arabic, and Russian.

Monokle is considered to be a spyware application that has a RAT or Remote Access Trojan functionality. It means the threat can be controlled remotely and may grant hackers access to infected devices. Cyber security specialists at Lookout.com, who discovered and researched the Trojan, claim the infection has capabilities that they have not seen all together in the wild. First of all, the malware can obtain various kinds of sensitive information. For example, the malicious application can exfiltrate information from third-party programs installed on an infected device. It can also install the so-called attacker-specified certificates to legit certificates available on the infected system. This should allow the cybercriminals behind Monokle to initiate man-in-the-middle (MITM) attacks. During such attacks, those behind them can alter communications between two particular parties without them realizing it. In other words, the messages could be changed, and neither of the two parties would understand that someone could be altering their texts.

Furthermore, Monokle might use predictive-text dictionaries that may allow them to discover conversations that could interest them. This may allow cybercriminals to obtain the information they seek and perform the earlier mentioned MITM attacks better. Further research showed that the Trojan might be able to take a screenshot of a user’s device at a time he is unlocking his screen. This could allow hackers to find out a user’s PIN code, screen lock pattern, or password. As a result, hackers could gain even more control over an infected device. The worst part is that victims may not notice anything that could be going on as the applications that Monokle might be installed with should work as they are supposed to. Thus, there is no doubt that detecting this infection could be extremely difficult.

All things considered, it seems the malware could put a victim’s privacy at risk and cause various trouble too. Thus, if you fear you could be targeted, we advise doing all you can to protect your device from it. To avoid receiving Monokle, users should be extra careful when installing new applications. Specialists recommend downloading software only from legitimate sources. Meaning, instead of clicking on pop-up ads that may offer a tool you wish to open, you should go directly to its website and obtain it from there. Of course, having a reputable antimalware tool that could guard your system against various malicious applications is just as important. Therefore, if you still have not picked such a security tool yet, we highly recommend considering it.