There are currently four malicious apps on the Google Play Store, the official app store for Android devices. These apps either redirect users to websites that steal sensitive information or offer their creators money in other ways (advertisements).
Many of these websites trick victims by offering them fake tools or updates to download, which then trick the user into manually installing malicious files.
See also: Google ad for GIMP.org spread info-stealing malware via similar site
The apps are still available on Google Play (at the time of writing) under a account called Mobile apps Group and have a combined total of over a million installs.
The same developer was previously caught distributing adware on Google Play twice . However, he was given permission to republish apps after submitting clean versions of the apps, according to a report by Malwarebytes.
The four malicious apps now detected in the Google Play Store are as follows:
- Bluetooth Auto Connect, with over 1,000,000 installations
- Bluetooth App Sender, with over 50,000 installations
- Driver: Bluetooth, Wi-Fi, USB, with over 10,000 installations
- Mobile transfer: smart switch, with over 1,000 installations
The apps have poor reviews on Google Play, and many users left comments about ads that automatically open in new browser tabs.
Interestingly, the developer responds to some of these comments and offers to help resolve the problems with the ads.
See also: Hackers abuse security software and distribute LODEINFO malware
Play Store: How do malicious Android apps work?
By monitoring app activity, Malwarebytes noticed that there is a ads or links appear phishing. After this initial delay, more tabs with similar content are opened every two hours in the browser.
Even when the device is locked, new tabs are opened in the browser, meaning that when users return to phone , they see multiple phishing and ads.
An analysis of the Manifest file showed that the developer tried to cover up the logs for the actions taken by using meaningless descriptions like “sdfsdf”.
See also: S3crets Scanner: Free tool to scan exposed Amazon S3 buckets
This method helped researchers identify actions more easily, although it is generally used to evade automated code scanners.
To avoid adware and other malware, it's a good idea to only download apps from official Android stores. Of course, in this case, the malicious Android apps were found in the official Play Store. So, there are a lot of things you need to be careful of. For example, reviews users' and take a look at the app's developer. If the developer is unknown and the reviews are negative, avoid the app. Also, pay attention to the permissions an app requests on your device. It can be helpful to monitor your battery usage and network data activity for any suspicious software. Another good way to keep device safe is to keep Google's Play Protect feature enabled.
If you have any of these apps, delete them immediately and run a full system scan with Play Protect or another antivirus program from a trusted source.
Source: www.bleepingcomputer.com
