Cybersecurity researchers at Dr.Web discovered a small number of Android apps pushing ads and secretly subscribing users to premium services.
The researchers reported that all of these Trojan apps were found in Google’s official Play Store app repository and had been installed approximately 2 million times in total.
These apps disguised themselves as games, messengers, wallpaper apps, etc., and primarily distributed three known malware families: FakeApp, Joker, and HiddenAds.
1 million downloads
When you install one of these apps, the icon on your device immediately changes to something you would be reluctant to remove, such as the Chrome browser. In some cases, the Trojan horse can remove icons completely, making it appear as if there is empty space in the app drawer, the researchers added.
The app then runs in the background and serves ads via the victim’s browser. That would bring huge benefits to developers. Ads include things like casino websites and fake investments, all of which violate Google’s policies.
The biggest Trojan to break through Google’s defenses and enter the Play Store is Super Skibydi Killer, a gaming app with 1 million downloads. Other notable mentions include Agent Shooter (500,000 downloads), Rubber Punch 3D (500,000 downloads), and Rainbow Stretch (50,000 downloads).
There are also apps that subscribe to premium services without the victim’s knowledge, such as Love Emoji Messenger (Korsinka Vimoipan) with 50,000 downloads and Beauty Wallpaper HD (fm0989184) with 1,000 downloads.
Google removed all apps from the Play Store before this article was published, but that only protects potential victims in the future. Users who have already downloaded the app will only be safe if they remove the app from their endpoint. If you suspect your device has been compromised, in addition to the apps listed above, look for the following apps:
Eternal Labyrinth (Yana Pospielova)
Jungle Jewels (Vaibhav Wable)
Secret of the Stars (Pepperstock)
Fire fruit (Candre Seville)
Cowboy Frontier (Precipice Game Studios)
Elixir of Enchantment (Acomadyi)
via peepee computer