F-Secure researchers have discovered a fake version of the “Minecraft-Pocket Edition” Android app that contains malicious code. The app is available to users for the tempting price of 2.50 euros, while the genuine app is sold for 5.49 euros.
Cybercriminals have added malicious code to the application, which aims to sign users up for Premium SMS subscription services.
Researchers have also observed that the app uses a hacking called “Smalihook” to bypass “the authentication process that causes the app to fail to execute if the correct app authenticity certificate is not found.”
The good news is that the malicious app is only hosted on third-party stores, and not on the official Google Play store. This is one of the reasons why researchers recommend that users only trust reputable stores for purchasing apps.
