Judy Android Malware: Security researchers at Checkpoint claim to have discovered what may be the largest malware campaign on the Google Play Store, which has already infected around 36.5 million Android devices with ad-click software.
Checkpoint has published on its blog more than 41 Android apps from a Korean company on the Google Play Store that allegedly earn money for their creators by generating fake advertising clicks from infected devices.
All of the malicious applications, developed by the Korea-based company Kiniwini, were distributed under the name ENISTUDIO Corp, and contained an adware program that researchers named Judy. Judy, as mentioned above, was used to generate fake clicks intended to generate advertising revenue.
Additionally, researchers also uncovered a few more apps, published by other developers on the Google Play Store, that inexplicably contain the malware itself.
The connection between the two campaigns remains unclear, although researchers believe it is possible that one developer borrowed code from the other, "knowingly or unknowingly.".
"It is very unusual to find an organization behind a malware campaign, as most of them are developed by purely malicious (autonomous) users," CheckPoint researchers report.
Apps available on the Play Store do not contain malicious code to bypass Google Bouncer protection.
Once downloaded and installed, however, the application silently logs the user's device to a remote control server and in response receives the actual malicious payload (Judy Android Malware) containing a JavaScript that starts the actual malicious process.
The malicious apps appear to be legitimate games, but in the background they act as a bridge connecting the victim's device to the adware server.
Once the connection is established, malicious applications alter the browser's user agents to "game" the browser to open pages and generate clicks.
Below is a list of malicious apps developed by Kiniwini (click on “Malicious Apps” to open the list). If you have any of these installed on your device, remove them immediately:
[su_spoiler title=”Malicious Applications” style=”fancy” icon=”folder-1″]
- Fashion Judy: Snow Queen style
- Animal Judy: Persian cat care
- Fashion Judy: Pretty rapper
- Fashion Judy: Teacher style
- Animal Judy: Dragon care
- Chef Judy: Halloween Cookies
- Fashion Judy: Wedding Party
- Animal Judy: Teddy Bear care
- Fashion Judy: Bunny Girl Style
- Fashion Judy: Frozen Princess
- Chef Judy: Triangular Kimbap
- Chef Judy: Udong Maker – Cook
- Fashion Judy: Uniform style
- Animal Judy: Rabbit care
- Fashion Judy: Vampire style
- Animal Judy: Nine-Tailed Fox
- Chef Judy: Jelly Maker – Cook
- Chef Judy: Chicken Maker
- Animal Judy: Sea otter care
- Animal Judy: Elephant care
- Judy's Happy House
- Chef Judy: Hotdog Maker – Cook
- Chef Judy: Birthday Food Maker
- Fashion Judy: Wedding day
- Fashion Judy: Waitress style
- Chef Judy: Character Lunch
- Chef Judy: Picnic Lunch Maker
- Animal Judy: Rudolph care
- Judy's Hospital: Pediatrics
- Fashion Judy: Country style
- Animal Judy: Feral Cat care
- Fashion Judy: Twice Style
- Fashion Judy: Myth Style
- Animal Judy: Fennec Fox care
- Animal Judy: Dog care
- Fashion Judy: Couple Style
- Animal Judy: Cat care
- Fashion Judy: Halloween style
- Fashion Judy: EXO Style
- Chef Judy: Dalgona Maker
- Chef Judy: ServiceStation Food
- Judy's Spa Salon
[/su_spoiler]
Google has already removed the above applications that contained the Judy Android Malware from the Play Store, but since Google Bouncer did not recognize them as malicious from the start, it would be a good idea to be careful what you download.
