Agent Smith

Agent Smith is a Trojan that modifies your applications by inserting advertisements or conducting other attacks. Although its current payloads utilize ad revenue generation as a primary motivation, the associated security flaws could lead to worse issues, such as theft of account passwords. Users should remove Agent Smith with a compatible Android anti-malware service and change any at-risk credentials.

Your Application isn't What It Used to Be

Between state-level spyware like MICROPSIA, the file-locking Trojan the QNAPCrypt Ransomware, and 'swiss army knives' like the WannaHydra, Android is coming under more fire from Trojan campaigns than previously in 2019. Another Trojan that's compatible with this phone-oriented OS is gaining footholds in multiple areas of the world, particularly India, Pakistan, Australia and Bangladesh. Thanks to a combination of fake gaming downloads and Google Play products, the so-called Agent Smith is tampering with the applications of hundreds of thousands of Android devices.

The first of Agent Smith's infection vectors uses third-party websites for promoting gaming-themed downloads that bundle the Trojan with them, whereas the second utilizes compromised or custom-designed Google Play store applications. All of the latter are no longer on Google's service.

After getting into the phone, Agent Smith searches for well-known applications that it can replace with its 'poisoned' variants. These variant applications include browsers like Opera, the WhatsApp messenger, and SwiftKey – a swiping keyboard utility. For now, all Agent Smith does with its 'update' is force the applications into displaying third-party advertising content, but malware experts confirm that the same structure of attack is adaptable for different goals, like collecting bank account logins.

Purging Android of Double Agents

For now, Agent Smith is restricting its payload to playing out as a stealthier form of adware that hijacks legitimate application with corrupted settings. Unlike 'ordinary' adware, however, Agent Smith isn't a Potentially Unwanted Program (PUP) – it installs itself without due consent and leaves no evidence of its presence on the Android device. Users may be capable of indirectly identifying the threat through symptoms, such as its advertisements, but these issues may not be persistent throughout every version of the Agent Smith Trojan.

Users can avoid downloading applications from third-party websites as a means of dodging the first of Agent Smith's two infection strategies, and Google has taken action for terminating the second of them. Software updates, also, play crucial roles in mitigating or blocking the vulnerabilities that this Trojan takes advantage of for its financial benefit.

Most AV vendors provide mobile phone-environment equivalents of their desktop anti-malware products. Victims can disinfect their phones and uninstall Agent Smith – and any infected applications – with such services and should take other precautions, such as changing passwords.

Agent Smith, much like its futuristic movie namesake, infects the bodies of other programs from the inside out. This insidious means of attacking phone owners is most easily prevented at the start before Agent Smith can start getting a foothold in your browsers or data.