A malicious app called “Album by Google Photos” was found in the Microsoft Store today, pretending to be created by Google. While it’s supposed to be part of Google Photos, it’s actually an ad clicker that automatically opens hidden ads repeatedly.
However, many users have downloaded and used the application, and from the reviews shown in the Microsoft Store, we understand that this is not an innocent application.
The Album by Google Photos app is a progressive web app that works like Google Photos, but with a built-in ad clicker. While the app is running, the hidden ad clicker loads ads and clicks on them, generating revenue for its developers.
The ad clicker add-on consists of 3 additional files that can be found in the application folder. The application names are 3D.dll, Block Craft 3D.exe, and Block Craft 3D.xr.
When the application is run, the user must log in to their account. The form that appears appears to be the official Google form, and after checking we did not find that the application steals user credentials. However, we would not recommend that you log in.
After the user logs in, the application connects to a URL and downloads a configuration file, which contains settings such as how often ads are loaded. After the application reads the configuration file, it starts running. Once running, the ads are displayed invisibly, without the user being able to see them. This means that when the ads lead to tech support scams, where sounds are played and the computer is infected, the user can hear it, but not see the page.
It is not yet known how this particular application passed Microsoft's security checks, but we hope it will be removed as soon as possible.
