Clones of several Showbox pirated movie apps that Samsung distributes to customers on its Galaxy Store may be infecting their devices with malware.
See also: Samsung Galaxy S20, Note 20 and Z Fold 2 receive One UI 4 update
Max Weinbach of Android Police reported the problem for the first time last night, identifying some apps that are based on Showbox and distributed on the Galaxy Store, some of which trigger Google's Play Protect warning when installed. And as far as we can tell, this warning is not unfounded. An analysis of one of the Showbox APKs by Virustotal shows over a dozen low-quality alerts from security vendors ranging from “riskware” to adware. Some of the apps also request more permissions than you would expect, such as access to contacts, call logs and the phone.
A later investigation revealed that the ad technology in the app can perform dynamic code execution, meaning that while the app itself as it is distributed may not contain malware directly, it can download and execute other code, which could include malware. Analyst Linuxct added that there are very few legitimate use cases for this functionality and it could be easily abused.
See also: Samsung: Its OLED displays upgrade laptop graphics
“It can turn into a trojan/malware at any time, so it’s not safe and that’s why so many vendors flagged it in VT/Play Protect.” Similar issues have been documented in at least two Showbox apps on the Galaxy Store, though they may affect others as well.
However, Samsung isn't just distributing apps that could potentially expose customers to malware. These apps are all clones of another well-known app called Showbox, which is reputed to provide access to copyrighted content, including movies and TV shows.
The app's descriptions claim that they do not host pirated content and do not allow piracy. However, the app has this reputation and some “experts” confirm that it uses piracy to some extent. Similar claims are made by self hosted sources of the Showbox app, advertising the app as “movie database” with an integrated VPN.Similar claims are made by self hosted sources of the Showbox app, advertising the app as “movie database” with an integrated VPN.
See also: Russia: Internet watchdog blocks six more VPNs
The Showbox subreddit notes that Showbox has been down for almost two years now and that the third‑party websites and apps purported to be related to it are “fake”. Google does not host any of those apps on the Play Store.
Samsung's Galaxy Store does not track the number of installations, but those apps have collectively hundreds of reviews, including several that note warnings about malicious software at the time of installation.
