Android Spyware Apps With 1.5M Installs Caught Hiding In Google Play, Delete ASAP

Time and time again, malware or malicious apps find their way to Google Play Store, infecting millions of people. In this same vein, researchers have discovered spyware with ties to China hiding in the Play Store disguised as file management apps.

This week, researchers at Pradeo discovered two spyware apps with a combined 1.5 million downloads on the Google Play Store. The apps, ‘File Recovery and Data Recovery’ and ‘File Manager,’ were found to be lying about the data they collected in the “Data Safety” section of the store. Behavioral analysis discovered that these apps were actually collecting a vast amount of sensitive data and shipping it to locations in China that were identified as malicious.


This data included contact lists, media compiled in the apps, real-time location, cellular information, and device information which the researchers claim could be leveraged to determine if the device is exploitable a la the Pegasus spyware. In total, each application performed “more than a hundred transmissions of the collected data, an amount that is so large it is rarely observed.”


Beyond the data collection, these apps are extra concerning as they implement some deceptive practices making them more potent. Namely, the threat actors behind these apps are believed to boost their app download numbers with install farms to make the apps seem more legitimate. Further, these apps are given advanced permissions upon download so they can launch and execute automatically without user interaction. Finally, these apps also disappear from the home screen, making it a little harder to uninstall or even know it is still on your device.

As malware is oft found on the Google Play Store, the researchers at Pradeo have a few recommendations to stay safe. This includes not downloading apps with few reviews and many users, carefully reading the permissions before accepting them, and reading reviews to see if there is anything of concern. Of course, many of these apps also have legitimate counterparts from reputable brands, so we recommend digging before simply installing an app. You never know when that random app could steal and ship your data overseas.

Thankfully, Google has removed the offending applications. A Google spokesperson reached out to let us that that, "These apps have been removed from Google Play. Google Play Protect protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources outside of Play."