E-Business
Cybercriminals Use Darknet to Sell Malicious Google Play Apps for up to US$20,000

After analysing offers of malicious apps on Google Play that are for sale on the Darknet, Kaspersky experts have discovered that malicious mobile apps and store developer accounts are being sold at up to US$20,000.
Using Kaspersky Digital Footprint Intelligence, researchers collected examples from nine different Darknet forums where the purchase and sale of goods and services related to malware is carried out.
The report sheds light on how threats sold on the Darknet appear on Google Play and also reveals the offers available, price range and features of communication and agreements between cybercriminals.
Even though official app stores are vigorously policed, moderator services can’t always catch malicious apps before they’re uploaded. Every year a vast range of malicious apps are deleted on Google Play only after victims have been infected.
Cybercriminals gather on the Darknet – a whole underground digital world with its own rules, market prices, and reputational institutions – to buy and sell Google Play malicious apps, and additional functions to upgrade and even advertise their creations.
Like on legitimate forums for selling goods, there are also various Darknet offers for different needs and customers with different budgets. To publish a malicious app, cybercriminals need a Google Play account and a malicious downloader code (Google Play Loader).
A developer account can be bought cheaply, for US$200 and sometimes even for as little as US$60. The cost of malicious loaders ranges between US$2,000 and $20,000, depending on the complexity of malware, the novelty and prevalence of malicious code, as well as the additional functions.
Most often, the malware being distributed is suggested to be hidden under cryptocurrency trackers, financial apps, QR-code scanners and even dating apps. Cybercriminals also highlight how many downloads the legitimate version of that app has, which means how many potential victims can be infected by updating the app and adding malicious code to it. Most frequently the suggestions specify 5,000 downloads or more.
For an additional fee, cybercriminals can obfuscate the application code to make it harder to detect by cybersecurity solutions. To increase the number of downloads to a malicious app, many attackers also offer to purchase installs – directing traffic through Google ads and attracting more users to download the app. Installs cost differently for each country.
The average price is US$0.50, with offers ranging from US$0.10 to several dollars. In one of the discovered offers, advertisements for users from the USA and Australia cost the most – US$0.80.
Fraudsters offer three kinds of work: for a share of the final profit, rent, and full purchase of either an account or a threat. Some sellers even hold auctions to buy their goods, since many sellers limit the number of lots sold.
For example, in one offer that was found, the starting price was US$1,500, with $700 incremental steps in the auction, and the blitz – the instant purchase for the highest price – was $7,000.
Darknet sellers can also offer to publish the malicious app for the buyer so they do not directly interact with Google Play, but can still remotely receive all of the victims’ detected data.
It may seem that in such a case the developer can easily deceive the buyer, but it is common among Darknet sellers to preserve and maintain their reputation, promise guarantees, or accept payment after the terms of the agreement have been completed.
To reduce risks when making deals cybercriminals often resort to the services of disinterested intermediaries, known as “escrow”. The escrow may become a special service and supported by a shadow platform, or a third party who is not interested in the results of the transaction.
“Malicious mobile apps continue to be one of the top cyberthreats targeting users, with more than 1.6 million mobile attacks detected in 2022. At the same time, the quality of cybersecurity solutions that protect users from these attacks is also increasing.
On the Darknet, we found messages from cybercriminals complaining how it is now much harder for them to upload their malicious apps to official stores. However, this also means that they will now come up with much more sophisticated circumvention schemes, so users should stay alert and carefully check which apps they are downloading,” comments Alisa Kulishenko, security expert at Kaspersky.
E-Business
Transcorp Hotels Delivers Stellar H1 Results, Declares Over ₦1Bn Dividend

Transcorp Hotels Plc has delivered a stellar performance in the first half of 2025, recording a 60% year-on-year surge in revenue to ₦47.57 billion, up from ₦29.72 billion in H1 2024. Gross profit climbed 71% to ₦36.21 billion, maintaining a strong 76% margin despite inflation and operational headwinds.
The hospitality giant, a subsidiary of Transnational Corporation Plc, also announced an interim dividend payout of ₦1.024 billion — offering ₦0.10 per 50 kobo ordinary share to shareholders.
In a bold move, the company unveiled Nigeria’s largest corporate venue — the 5,000-seat Transcorp Centre — staking its claim as the new leader in event hospitality. Chairman Emmanuel Nnorom described the results as proof of Transcorp Hotels’ transformative strategies and unwavering investor commitment. MD/CEO Uzo Oshogwe attributed the success to relentless execution and a resilient business model.
Transcorp Hotels, renowned for iconic assets like Transcorp Hilton Abuja and its digital platform Aura, says it isn’t just leading Nigeria’s hospitality sector — it’s redefining excellence across Africa.
E-Business
Microsoft Servers Hacked by Chinese Groups

Chinese “threat actors” have hacked Microsoft’s SharePoint document software servers and targeted the data of the businesses using it, the firm has said.
China state-backed Linen Typhoon and Violet Typhoon as well as China-based Storm-2603 were said to have “exploited vulnerabilities” in on-premises SharePoint servers, the kind used by firms, but not in its cloud-based service.
The US tech giant has released security updates in response and has advised all on-premises SharePoint server customers to install them.
“Investigations into other actors also using these exploits are still ongoing,” Microsoft said in a statement.
The firm said it had “high confidence” the hackers would continue to target systems which have not installed its security updates.
It added that it would update its website blog with more information as its investigation continues.
Microsoft said it had observed attacks in which hackers had sent a request to a SharePoint server “enabling the theft of the key material by threat actors”.
Charles Carmakal, chief technology officer at Mandiant Consulting firm, a division of Google Cloud, told reporter, it was “aware of several victims in several different sectors across a number of global geographies”.
Carmakal said it appeared that governments and businesses that use SharePoint on their sites were the primary target.
A number of adversaries who stole material encoded by cryptography were then able to regain ongoing access to the victims’ SharePoint data, he said.
“This was exploited in a very broad way, very opportunistically before a patch was made available. That’s why this is significant,” Carmakal said.
Carmakal said the “China-nexus actor” was deploying techniques similar to previous campaigns associated with Beijing.
Microsoft said Linen Typhoon had “focused on stealing intellectual property, primarily targeting organizations related to government, defence, strategic planning, and human rights” for 13 years.
It added that Violet Typhoon had been “dedicated to espionage”, primarily targeting former government and military staff, non-governmental organizations, think tanks, higher education, the media, the financial sector and the health sector in the US, Europe, and East Asia.
Meanwhile, Storm-2603 was “assessed with medium confidence to be a China-based threat actor”.
E-Business
NIMC Warns Nigerians of Fake NIN Website

National Identity Management Commission (NIMC) has issued a public warning that it is not associated with NINcard.com.
According to the commission, the website has been circulating online to offer services for Nigerians seeking National Identification Number (NIN) services.
NIMC, in a post on its official X account on Wednesday, said, “NINcard.com is not in anyway affiliated to NIMC. Stay vigilant!”
The warning was accompanied by screenshots of fake payment receipts and OTP request pages from the website, both of which were boldly stamped “FAKE” by NIMC to alert the public.
- Telecom2 days ago
Glo Launches Nigeria’s First-of-its-kind Device Protection Plan
- Telecom2 days ago
Telcos: How and Why Network Services have Been Poor
- Broadcasting2 days ago
Canal+ Clears Final Hurdle to Acquire South Africa’s MultiChoice
- E-Business2 days ago
NIMC Warns Nigerians of Fake NIN Website
- Telecom2 days ago
MTN Executive Adeola Oduntan Emerges as Africa’s Supply Chain Leader of 2025
- Telecom2 days ago
MTN Nigeria Sweeps Africa’s Procurement Awards With Innovation and Impact
- E-Business2 days ago
Microsoft Servers Hacked by Chinese Groups
- Telecom2 days ago
Telegram to allow U.S. users send, receive crypto directly in app