Android malware campaign 'targets 1 million Google accounts'

Check Point says Android malware campaign can steal tokens from Google accounts

More than one million Google accounts have been compromised by a new authentication-theiving malware campaign called Gooligan, according to security company Check Point.

In a blog post, Check Point said the malware steals authentication tokens from infected Android devices, which can later be used to access Google Play, Gmail, Google Photos, Google Docs, G Suite, Google Drive and other data stored with Google.

The Gooligan malware campaign appears to affect 74% of in-market devices, particularly those running on Android 4 (JellyBean, KitKat) and 5 (Lollipop).

Around 57% of these devices are in Asia and 9% are in Europe. Android users can check whether their account is compromised here.

Check Point suggested that, if an account has been breached, users should carry out a clean installation ("flashing") of the operating system on the affected mobile device. As this is a complicated process, however, the company said users may want to power off the device and ask their mobile service provider or a certified technician to 're-flash' the device.

Check Point also recommended changing all Google account passwords once the "flashing" process is complete.

The security company is working closely with Google to investigate the source of this campaign.

Adrian Ludwig, Google's director of Android security, said: "We're appreciative of both Check Point's research and their partnership as we've worked together to understand these issues. As part of our ongoing efforts to protect users from the Ghost Push family of malware, we've taken numerous steps to protect our users and improve the security of the Android ecosystem overall."

To counteract the malware campaign, Google is reportedly notifying affected accounts, revoking affected tokens and deploying SafetyNet improvements.

Featured Resources

Transform the operator experience with enhanced automation & analytics

Bring networking into the digital era

Download now

Artificially intelligent data centres

How the C-Suite is embracing continuous change to drive value

Download now

Deliver secure automated multicloud for containers with Red Hat and Juniper

Learn how to get started with the multicloud enabler from Red Hat and Juniper

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now


email delivery

How to recover deleted emails in Gmail

20 Jun 2019

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Google Android

How to unroot Android

14 Jan 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular


Patch issued for critical Windows bug

11 Dec 2019
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019

Buy IT to grow, not slow, your business

25 Nov 2019
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019