Cybersecurity researchers at Zscaler have discovered three Android malware families, “Joker”, “Facestealer”, and “Coper”, that managed to infiltrate the Google Play Store by hiding their malicious payloads inside seemingly harmless apps.
Users who have installed these malicious applications are at risk, as the theft data, take control of social media accounts, intercept SMS, and can also secretly charge users by signing them up for subscription services.
See also: Knauf: German company fell victim to cyberattack
The analysts notified Google of their findings, and all apps have since been removed from the Play Store. However, those still using these malicious apps should uninstall them from devices and perform a device upgrade to root out any remnants.
Joker Android malware
Joker is a well-known Android malware that is used to steal information from compromised devices. The malware can steal the victim's SMS messages and contact lists, while also secretly enrolling users in premium servicesand charging them.
According to the Zscaler researchers' report , at least 50 apps were hiding Joker . These apps had a combined total of over 300,000 downloads on the Play Store.
| Simple Note Scanner – com.wuwan.pdfscan |
| Universal PDF Scanner – com.unpdf.scan.read.docscanuniver |
| Private Messenger – com.recollect.linkus |
| Premium SMS – com.premium.put.trustsms |
| Smart Messages – com.toukyoursms.timemessages |
| Text Emoji SMS – messenger.itext.emoji.messenger |
| Blood Pressure Checker – com.bloodpressurechecker.tangjiang |
| Funny Keyboard – com.soundly.galaxykeyboard |
| Memory Silent Camera – com.silentmenory.timcamera |
| Custom Themed Keyboard – com.custom.keyboardthemes.galaxiy |
| Light Messages – com.lilysmspro.lighting |
| Themes Photo Keyboard – com.themes.bgphotokeyboard |
| Send SMS – exazth.message.send.text.sms |
| Themes Chat Messenger – com.relish.messengers |
| Instant Messenger – com.sbdlsms.crazymessager.mmsrec |
| Cool Keyboard – com.colate.gthemekeyboard |
| Fonts Emoji Keyboard – com.zemoji.fontskeyboard |
| Mini PDF Scanner – com.mnscan.minipdf |
| Smart SMS Messages – com.sms.mms.message.ffei.free |
| Creative Emoji Keyboard – com.whiteemojis.creativekeyboard.ledsloard |
| Fancy SMS – con.sms.fancy |
| Fonts Emoji Keyboard – com.symbol.fonts.emojikeyboards |
| Personal Message – com.crown.personalmessage |
| Funny Emoji Message – com.funie.messagremo |
| Magic Photo Editor – com.amagiczy.photo.editor |
| Professional Messages – com.adore.attached.message |
| All Photo Translator – myphotocom.allfasttranslate.transactiontranslator |
| Chat SMS – com.maskteslary.messages |
| Smile Emoji – com.balapp.smilewall.emoji |
| Wow Translator – com.imgtop.camtranslator |
| All Language Translate – com.exclusivez.alltranslate |
| Cool Messages – com.learningz.app.cool.messages |
| Blood Pressure Diary – bloodhold.nypressure.mainheart.ratemy.mo.depulse.app.tracker.diary |
| Chat Text SMS – com.echatsms.messageos |
| Hi Text SMS – ismos.mmsyes.message.texthitext.bobpsms |
| Emoji Theme Keyboard – com.gobacktheme.lovelyemojikeyboard |
| iMessage – start.me.messager |
| Text SMS – com.ptx.textsms |
| Camera Translator – com.haixgoback.outsidetext.languagecameratransla |
| Coming Messages – com.itextsms.messagecoming |
| Painting Photo Editor – com.painting.pointeditor.photo |
| Rich Theme Message – com.getmanytimes.richsmsthemessenge |
| Quick Talk Message – messages.qtsms.messenger |
| Advanced SMS – com.fromamsms.ataadvancedmmsopp |
| Professional Messenger – com.akl.smspro.messenger |
| Classic Game Messenger – com.classcolor.formessenger.sic |
| Style Message – com.istyle.messagesty |
| Private Game Messages – com.message.game.india |
| Timestamp Camera – already.taken.photobeauty.camera.timestamp |
| Social Message – com.colorsocial.message |
Nearly half of these were communication apps, which easily require users to grant permission to access sensitive information, making it easier for malware to gain the high-level privileges needed for its malicious operation.
See also: Magecart: 50,000 credit cards stolen from 300 restaurants
According to researchers, Joker developers are now hiding the payload in a common asset file, in obfuscated base64 format, sometimes giving it a JSON, TTF, PNG file extension.
“Many Joker apps hide the payload in the assets folder of the Android Package Kit (APK) and create an ARM ABI executable to avoid detection by most x86-based sandboxes,” Zscaler explains in the report.
Facestealer Android malware
As the name suggests, Facestealer malware steals Facebook using fake login forms.
Researchers found an app hiding this malware family in its code. It is a seemingly harmless app called “Vanilla Snap Camera,” and it has been downloaded about 5,000 times.
Android malware scanner
Coper is a malware that steals information, such as SMS messages, while it can also record text entered on devices, perform attacks , send malicious SMS messages, and send data back to the attacker's servers.
Zscaler analysts found at least one app, called “Unicc QR Scanner,” that was hiding Coper in its code and compromised about 1,000 devices.
See also: Why are hackers turning to cloud storage services?
Although the app itself does not initially contain malicious code, once installed and opened on the device, it will download the malware via a fake program update.
How to stay safe
To stay safe and avoid getting infected with Android malware, avoid installing too many apps. Make sure you only download the apps you absolutely need , and before you do , read reviews from other users to see if they say anything strange. Also, only choose apps from well-known and large publishers. Finally, before installing, carefully check the permissions the app requests and avoid granting access to sensitive data, especially if they don't seem to be related to the app's core functionality.
Also, make sure Play Protect is active on your device and regularly monitor network data and battery consumption to discover any suspicious processes running in the background.
Source: www.bleepingcomputer.com
