More than 500,000 Huawei users were infected with Joker malware after downloading infected apps from the company’s official Android store. Joker malware is malicious code that appears as a system app and allows attackers to perform a wide range of malicious functions, including disabling Google Play Protect, installing malicious apps, creating fake reviews, and displaying ads. This malware can also steal SMS messages, contact lists, and device information, as well as enroll victims in premium service subscriptions.
Read also: Android malware disguises itself as Netflix app and hacks WhatsApp conversations
Experts from “Doctor Web”, an antivirus protection company, discovered ten applications in the AppGallery that contained the malicious code. A post published by Doctor Web states the following: “Doctor Web virus analysts have uncovered the first malware in the AppGallery ― the official app store from the Android device manufacturer “Huawei”. They turned out to be dangerous Android. Joker trojans that work mainly to register users to premium mobile phone services. In total, our experts discovered that 10 modifications of these trojans have been found in the AppGallery, with more than 538,000 users having installed them.”
To keep users "in the dark," the infected apps requested access to notifications, which allowed them to intercept confirmation codes delivered via SMS by the subscription service.
See also: New Android malware appears as a system update!
According to the researchers, the malware could register a user with a maximum of five services, although malicious actors could modify this number at any time.
The list of malicious apps included virtual keyboards, a camera app, a launcher, an online messenger, a sticker collection, coloring programs, and a game.
Most of them came from a single developer (Shanxi Kuailaipai Network Technology Co., Ltd.). Doctor Web notified Huawei about these apps, and the company removed them from the AppGallery. While new users can no longer download them, those who already have the apps running on their devices must perform a manual cleanup.
According to the researchers, the same modules downloaded from the infected apps on AppGallery were also present in other apps on Google Play, which were used by other versions of the Joker malware.
Proposal: Huawei: Removes Nike and Adidas from its app store
Once activated, the malware “communicates” with its remote server to receive the configuration file, which contains a list of tasks, websites for premium services, and JavaScript that “mimics” user interaction.
The Joker malware story began in 2017, with it consistently found in apps distributed through the Google Play store. In October 2019, Tatyana Shishkova, an Android malware analyst at Kaspersky, tweeted about more than 70 apps from the official store that had the malware. And reports of malware on Google Play continued. In early 2020, Google announced that since 2017, it had removed about 1,700 apps that were infected with Joker. As of last February, Joker was still present in the store and continued to bypass Google’s defenses, even in July of last year.
Information source: bleepingcomputer.com
