FortiGuard Labs reports TinstaPorn Android casino app malware
Hackread reports FortiGuard Labs found TinstaPorn, a fake Macau casino Android app that collects phone and location data; avoid sideloading it.
- Published
- Ecosystem
- Desktops, browsers and mobile
- Exploitation
- Not confirmed. Hackread reports FortiGuard Labs analysis of the app, with no victim counts or distribution method stated.
What happened
Hackread reports that FortiGuard Labs analysed a malicious Android application called TinstaPorn, which poses as an online version of a famous casino in Macau. The app is identified as Android/TinstaPorn.A!tr, according to Hackread. The research was shared with Hackread by FortiGuard Labs; no FortiGuard primary publication was among the sources provided, so this advisory relies on Hackread’s account of it.
Per Hackread, FortiGuard says that despite the name, the app has nothing to do with adult content. It offers casino games such as slots and roulette, and the odds are manipulated in the operators’ favor. Hackread says FortiGuard did not explain how the outcomes are manipulated. The platform also encourages spending through VIP balance top-ups, rebates and referral rewards, according to the same report.
Hackread reports that FortiGuard found the app collects phone numbers and precise location information, including latitude, longitude, location accuracy and timestamps. It sends this to game servers through routes including /loc/geo-location and /bind_phone, and sends device identification details and other technical information to a separate logging server. According to the report, this lets operators fingerprint individual devices and link a phone number and gambling account to a device and physical location.
Other technical points Hackread attributes to FortiGuard:
- The app was built with Flutter, which FortiGuard says makes analysis harder because of a different Application Binary Interface (ABI).
- The app first contacts configuration files hosted on GitHub and Gitee. Per the report these files provide server addresses, not executable code.
- It registers the device, obtains game server addresses from line configuration servers, stores them in a local SQLite database, has hardcoded fallback servers, and tests server response times.
- Traffic uses AES encryption and HMAC-SHA256 signatures, but the AES key is supplied in cleartext by the line configuration server, so the encryption mainly obscures traffic, per the report.
FortiGuard Labs researcher Axelle Apvrille is quoted by Hackread as saying the operation “reflects well-planned development, with a clean infrastructure, multiple REST APIs, and a full ecosystem.”
Not confirmed in the source: how the app is distributed, how many devices are affected, who operates it, whether any user data has been misused, and whether any app store has removed it.
Am I affected?
Based only on Hackread’s report, you are potentially affected if an app matching this description, a Macau-style casino app identified as Android/TinstaPorn.A!tr, is installed on an Android device. The source does not give a package name, file hash, version, app store listing or download location, so it is not possible to confirm from the sources how to identify an installed copy other than by that detection name.
The source does not state that any specific store or region is involved, and it does not report a CVE or a vulnerability in a legitimate product. Whether endpoint security tools detect it under the name above is not confirmed beyond FortiGuard’s own naming.
What to do now
- Check Android devices for casino or gambling apps that were not installed from a source you trust, and uninstall any that you cannot vouch for.
- If a Macau-style casino app was installed, assume the phone number, location history and device details it could access may have been sent to its operators, as Hackread reports FortiGuard describes. Whether any specific data was actually taken is not confirmed.
- If you run mobile security tooling, check whether it detects Android/TinstaPorn.A!tr, the name Hackread reports FortiGuard uses.
- Do not top up balances or use referral or rebate offers in such an app, since Hackread reports FortiGuard says the odds favor the operators.
- Watch for a primary FortiGuard Labs publication for indicators such as hashes and domains; none were provided in the sources.