Cybersecurity researchers at Dr.Web discovered a handful of Android apps that pushed ads and secretly subscribed people to premium services.
The researchers reported that these Trojan apps, all found in Google’s official Play Store app repository, have been cumulatively installed approximately two million times.
The apps posed as games, messengers and wallpaper apps and mainly distributed three well-known malware families: FakeApp, Joker and HiddenAds.
One million downloads
Upon installing any of these apps, they immediately changed their icon on the device to something the user would be reluctant to uninstall, like the Chrome browser. In some cases, the researchers added, the Trojans simply removed their icons altogether, making it appear as if there was an empty space in the app drawer.
The apps would then start in the background and deliver advertisements to the victim through their browser. That way they would generate significant profits for the developers. The ads include things like casino websites, fake investments and the like, all of which are against Google’s policies.
The biggest trojan that managed to bypass Google’s defenses and penetrate the Play Store is Super Skibydi Killer, a gaming app with a million downloads. Other notable mentions include Agent Shooter (500,000 downloads), Rubber Punch 3D (500,000 downloads), and Rainbow Stretch (50,000 downloads).
There are also apps that subscribe victims to premium services without their knowledge, including Love Emoji Messenger (Korsinka Vimoipan) with 50,000 downloads and Beauty Wallpaper HD (fm0989184) with 1,000 downloads.
Although Google removed all apps from the Play Store before this article was published, this only protects future potential victims. Those who have already downloaded the apps can only be safe if they remove them from their endpoints. If you suspect your device has been compromised, in addition to the apps mentioned above, also look for these:
Eternal maze (Yana Pospyelova)
Jungle Jewels (Vaibhav Wable)
Stellar Secrets (Pepperstocks)
Fire Fruits (Sandr Sevilla)
Cowboy’s Frontier (Precipice Game Studios)
Enchanted elixir (Acomadyi)
Through BleepingComputer