A new Android Trojan discovered by security researchers in the Google Play Storeuses fake notifications to redirect users to dangerous websites.
Doctor Web researchers discovered several fake applications, posing as well-known brands, that were spreading the Trojan, called Android.FakeApp.174. After reporting it to Google, the company removed the applications in question.
The malicious apps were not installed by many users (around 1000). However, hackers could republish similar apps on the Play Store and use more dangerous methods, targeting banks and spreading fake news.
As Doctor Web researchers explain, “Victims may think the fake alert is real and click on it, which will redirect them to a phishing website, where they will be asked for their name, credentials, email addresses, bank card numbers, and other confidential information.”
The Android.FakeApp.174 Trojan asks its victims to allow notifications under the pretext that the user is not a bot. After the user agrees to enable notifications for “verification purposes,” the device owner will receive spam messages, with dozens of notifications sent from Chrome using Web Push technology.
This technology makes it possible to send notifications even when the browser is closed, when the website is not open in the browser, and even after the Trojan has been removed from the system.
“These messages appear in the device’s notification panel and may be misinterpreted as system messages. They may resemble notifications from social media, dating sites, news agencies, and other well-known services,” according to Doctor Web.
Scammers use these camouflaged notifications to redirect users to dangerous websites, where they can trick them into giving up their login credentials or even more personal information like credit card numbers.
Doctor Web researchers advise users to be cautious about the notifications they receive and not to register with their details if a site is unknown to them or seems suspicious.
