Shedun

Shedun is an Android malware family described by Lookout as part of a sophisticated wave of trojanized adware alongside the related families Shuanet and ShiftyBug. It was reported to be embedded in fake or repackaged versions of popular Android applications, including apps associated with brands such as Facebook, Twitter, Candy Crush, Snapchat, and WhatsApp, and Lookout stated that these families were present in more than 20,000 apps in Google Play. The malware could silently root infected Android devices in the background using exploits or techniques associated with Memexploit, Framaroot, and ExynosAbuse, then embed itself deeply into the system, making removal extremely difficult and in some cases effectively forcing victims to replace the device. Victims often first noticed infection through unwanted advertisements. Lookout assessed that the malware families shared code and infrastructure and that two or more groups may have been involved in the campaigns; antivirus apps appeared to have been deliberately excluded from repackaging. Reported infection concentrations included the United States, Germany, Iran, Russia, India, Jamaica, Sudan, Brazil, Mexico, and Indonesia. Additional reporting noted code similarities linking later malware installers back to installers for Shedun Android malware, indicating reuse or lineage connections beyond Android. High-confidence indicators mentioned in the content are limited to the use of rooting components associated with Memexploit, Framaroot, and ExynosAbuse; no specific Shedun file hashes or domains were provided in the content.