Mobile security experts from Check Point have stumbled upon a new malware variant for Android that specializes in displaying advertisements by making hidden calls to premium service numbers.
Check Point named this malware CallJam, due to the large number of calls it makes.
The app through which Android users were infected with CallJam is called Gems Chest for Clash Royale and Google has proceeded with its removal.
Before it was removed, the app had between 100,000 and 500,000 downloads and a positive rating of 4.0.
Check Point says this rating was fake and did not reflect the true nature of the app, because the app itself rewarded users who had rated the game using in-game currencies.
On a technical level, CallJam is more difficult than other adwarebecause it does not interrupt the user during gameplay, but opens a browser and displays the ads there.
The app's killer feature is its ability to make premium calls. Fortunately, the app should ask for permission to do this, but we all know that some users install anything presented in pop-ups.
Therefore, CallJam has managed to infect a fairly large number of users!
One of the users spotted this “behavior” and submitted a review on the app’s Google Play Store, where he wrote:
"It [the app] dialed a wrong international no. [number] Continuously Wtf."
In early September, Check Point also detected the DressCode Android malware hidden in more than 40 apps uploaded to the Google Play Store.
In August, Intel's McAfee team discovered six more apps that managed to bypass Google's strict security measures.
