CamScanner Android App: Another Android malware found in the Google Play app store.
Researchers from Kaspersky Lab said they found an app with 100 million downloads that hosted a malicious module that sent ads or illegally downloaded apps to compromised Android devices.
The malicious component was found by researchers after they were notified of "suspicious behavior" in the free version of the popular scanning app CamScanner following a flurry of negative comments from users regarding its validity.
“CamScanner was actually a legitimate app, free of malicious activity, for quite some time,” Kaspersky. “It used ads to generate revenue and started allowing in-app purchases. However, at some point, this changed and recent versions of the app are sending ads containing a malicious module.”
This module – identified as Trojan-Dropper.AndroidOS.Necro.n – is a trojan dropper, meaning it can extract and execute a second malicious component encrypted within the application. This trojan downloader can be used to infect devices with other types of malware.
Kaspersky researchers found that when CamScanner was run, the dropper decrypted and executed malicious code contained in a “mutter.zip” file within the application, before downloading encrypted code from a command-and-control server “https://abc.abcdserver[.]com.”
“The above Trojan-Dropper.AndroidOS.Necro.n functions perform the malware’s primary function: downloading and launching a payload from malicious servers,” the researchers said. “As a result, the unit’s owners can use an infected device to their advantage in any way they see fit, such as stealing money from the victim’s account or charging for paid subscriptions.”
Google removed the app from the Play Store after Kaspersky's findings were made public, but the app's developers confirm that they removed the malicious code in their most recent update.
Problems like this plague the Play Store
Hackers can hide their true intent and insert malicious code by bypassing Google's app review process .
If you use CamScanner, you may want to consider switching to alternatives like Microsoft OneNote, Google Drive , or Apple Notes.
While sticking to the Play Store is still the safest way to download apps, make sure you check their permissions, reviews, and only download them if they are absolutely necessary for your daily needs.
