Cybersecurity researchers at Dr.Web have recently identified a group of Android apps that were engaging in deceptive advertising and unauthorized subscription sign-ups. These trojan apps were discovered on Google’s official Play Store app repository and had collectively amassed around two million installations.
Disguised as various applications such as games, messengers, and wallpaper apps, these malicious apps were primarily distributing three well-known malware families – FakeApp, Joker, and HiddenAds.
Upon installation, these apps would promptly change their icons on the device, often to mimic popular apps like the Chrome browser, thus making them difficult to identify and remove. In some cases, the trojans would even completely remove their icons, creating the illusion of empty space on the user’s app drawer.
Once launched, these apps operated in the background and delivered intrusive ads to users through their browsers. This allowed the developers to generate substantial profits while violating Google’s policies, as the ads included promotions for casino websites, fake investments, and other prohibited content.
The most concerning trojan to have infiltrated the Play Store was Super Skibydi Killer, a game app with over a million downloads. Other notable apps included Agent Shooter (500,000 downloads), Rubber Punch 3D (500,000 downloads), and Rainbow Stretch (50,000 downloads). Additionally, there were apps like Love Emoji Messenger (Korsinka Vimoipan) with 50,000 downloads and Beauty Wallpaper HD (fm0989184) with 1,000 downloads that would silently subscribe victims to premium services without their knowledge.
While Google has taken prompt action by removing all of these apps from the Play Store, it is important for individuals who have already downloaded them to delete them from their devices to ensure their safety. If there are any suspicions of compromised devices, users should also be on the lookout for the following apps: Eternal Maze (Yana Pospyelova), Jungle Jewels (Vaibhav Wable), Stellar Secrets (Pepperstocks), Fire Fruits (Sandr Sevill), Cowboy’s Frontier (Precipice Game Studios), and Enchanted Elixir (Acomadyi).
By sharing this information, we aim to protect potential future victims from falling prey to these malicious apps.
