January 11, 2024
SBI Holdings Inc.
SBI EVERSPIN Co., Ltd

Notice of Attention Regarding Malicious Apps Detected by Fake Finder,
an AI-based Malicious App, etc. Detection App for Android OS- Report on the state of Malicious Apps in November and December 2023 SBI EVERSPIN Co., Ltd. (Head office: Minato-ku, Tokyo; Representative Director and President:Jamyung Yoon; hereinafter “the Company”), a consolidated subsidiary of SBI Holdings, Inc. (Headoffice: Minato-ku, Tokyo; Representative Director, Chairman, President & CEO: Yoshitaka Kitao),
which provides an AI-based malicious app detection app “Fake Finder for SBI Group” free of charge
to customers using services of SBI Group companies exclusively for Android hereby announces thatit have found Malicious Apps, etc., to call for attention.
1. Type of Malicious Apps
1.1．Type：Fraudulent applications that exploit personal information or Fake applications thatimpersonate financial institutions or public institutions, etc.
1.2．Description: Apps created for malicious purposes, such as plagiarizing the name or icon ofthe relevant institution
1.3．Example: Require excessive privileges to have full control over smartphones
Automatically download and install other “malignant apps” on smartphones
2. Information and Initial Detection Time of Malicious Apps
CasePACKAGE_NAME

Initial Detection TimeA

Chrome2023-11-28 15:24:10

B

SyncService

2023-12-08 16:33:48

C

Chrome2023-12-15 14:42:31

3. Characteristics of Malicious Apps (Chrome Case Study and SyncService (app name: hoverwatch)
Case Study)
3.1．Basics
Case A and C : Chrome fake application uses Unicode for “C” and “e” as a font that looks almost
the same but is different from the usual
Case B: Fake app spoofing “hoverwatch (name of monitoring app)”

3.2．Operation
Case A and C : Demand excessive authority to exploit personal information
Case B: Request excessive privileges to install additional invisible “malicious apps” andtake full control of smartphones- Request permission to access phone, files and media, SNS, and contacts

3.3．UI features：Icons are hidden and not visible, or additional “malicious apps” are installed
After installing “Chrome” spoofing apps,
Icons are hidden and not visible

After installing “hoverwatch” spoofing apps,
Malignant Apps are installed automatically

4．Operation of Malicious Apps
: Request permission to access phone calls, files and media, SMS, contacts

5. Other remote control application(*) detection results in “Fake Finder” during the same period
Total Period

Number of remote control apps detected

November-December 2023

1,482 cases(*) Remote control application: An application that monitors or operates a smartphone in a remotelocation
Malicious apps such as the above are often distributed outside of the official market, and sinceAndroid devices can obtain apps from providers other than Google Play, malicious apps are distributedby taking advantage of this. Nowadays, many smartphone apps are provided by various developers,
and attackers take advantage of the fact that users install apps on a daily basis to lead them tomalicious apps. Therefore, inadvertent download of apps may lead to unexpected damage. In order toavoid damage from malicious apps, it is necessary to obtain apps from official markets in principle,
and to carefully check the developer’s reliability, functions of the app, terms of use, etc. when selectingapps.
The Company will continue to focus on protecting the safety and security of its customers’ smartphone
usage environment by regularly distributing information on malicious apps and other topics to help
prevent its customers from becoming victims of phishing scams, etc., and as announced on October 6,
2023, as well as to inform related organizations about the current state of malicious apps bycollaborating with the Japan Cybercrime Control Center (JC3), of which it is a regular member of. In
addition, by collaborating with the Japan Cybercrime Control Center (JC3), the company willendeavor to promote awareness of malicious apps among related organizations, thereby leading toactivities to prevent financial damage caused by use of smartphones.
Using the expertise that the Company has gained through continuous research on cutting-edge
security technologies and years of security vulnerability assessments to protect its customers’ systems
from the ever-evolving damage caused by unauthorized access, such as hacking, the Company will
endeavor to realize a secure society where customers can confidently use digital environments andfocus on their core business services.
********************************************************************************************For further information, please contact:
SBI EVERSPIN Co., Ltd. contact@sbieverspin.com