These Four Android Apps On Google Play Exposed 1M Devices To Malware, Delete ASAP
Security researchers at Malwarebytes Labs have discovered a small handful of malicious Android apps loitering in Google Play, which collectively have racked up over 1 million installations. According to the researchers, each of the four malicious apps is contaminated with a Trojan that serves up adware and directs users to harmful phishing sites. What's really interesting, though, is a clever tactic it employs to avoid arousing suspicion that something is amiss.
Instead of getting right to work luring potential victims to phishing sites, the Trojan stands pat for three full days (72 hours) before displaying the first ad.
"Delaying malicious behavior is a common tactic to evade detection by malware developers. It turns out that this app uses delays quite a bit...After the initial delay, the malicious app opens phishing sites in Chrome. The content of the phishing sites varies—some are harmless sites used simply to produce pay-per-click, and others are more dangerous phishing sites that attempt to trick unsuspecting users," Malwarebytes Labs explains.
The infected apps purportedly serve up fake update notices in Chrome like the ones above (Source: Malwarebytes Labs)
Even sneakier, infected devices open Chrome tabs in the background even when an Android phone or tablet is locked. Since new tabs are opened so frequently, users who leave their phone or tablet locked for a few hours will see a whole bunch of malicious sites when returning to their device. And while not mentioned, we imagine this also puts a drain on battery life.
Suffice to say, if you have any of these apps on your Android phone, you should uninstall them immediately...
- Bluetooth Auto Connect: Over 1,000,000 installs (3.5-star rating)
- Bluetooth App Sender: Over 50,000 installs (3.3-star rating)
- Driver: Bluetooth, Wi-Fi, USB: Over 10,000 installs (3.8-star rating)
- Mobile transfer: smart switch: Over 1,000 installs (no rating)
All four of these apps are by Mobile apps Group, an app developer with a history of distributing malicious apps infected with different variants of the HiddenAds Trojan, according to Malwarebytes Labs.
While we are refraining from posting links to the apps in Google Play (they're in the security report), we have verified that they remain available to download and install on Android devices at the time of this writing. Three of them have favorable ratings to boot. The developer is also active in the user reviews section, responding to comments both good and bad.
