Over 60,000 Android Apps Silently Install Malware On Devices

By Author: Itctrls
Total Articles: 2
Comment this article

Recently, cybersecurity researchers uncovered that over 60,000 Android applications had been stealthily disguised as genuine software for the past six months.

It has been identified that these malicious apps have been secretly implanting adware onto unsuspecting mobile devices without detection.

Utilizing an anomaly detection feature integrated into its Bitdefender Mobile Security software just a month ago, Bitdefender effectively identified the malicious apps.

Distribution
The distribution of this campaign, suspected to have begun in October 2022, takes various forms, including:-

Fake Security Software
Fake Game Cracks
Fake Cheats
Fake VPN Software
Fake Netflix
Fake Utility Apps On Third-Party Sites
Fake Tutorials
YouTube/TikTok Without Ads
Fake Videos

The malware strategically emerges when users search for apps, mods, cracks, and related materials, facilitating an organic distribution pattern.

Notably, a growing and profitable market for modded apps leads to specialized websites entirely devoted to offering these enticing ...
... collections.

This malware campaign has targeted users from the following countries:-

The United States
South Korea
Brazil
Brazil
Germany
The United Kingdom
France
The primary essence of modded apps lies in their ability to modify original applications, granting full access to their functionality or introducing programmed changes.

Installed and Evade Detection Stealthily
Google Play remains free from the clutches of malicious apps, as they prefer to reside on third-party websites discovered via Google Search, enticing users with APKs.

While browsing these sites, expect to be redirected to websites that showcase the advertisements or encounter prompts luring you to download the requested application.

According to the Bitdefender report, These download platforms are purposefully designed to function as distribution hubs for Android apps embedded with malicious code, capable of infecting Android devices with adware upon installation.

To avoid additional privileges, the app, after the installation, does not self-configure itself to initiate automatic execution.

Instead, it entirely depends on the regular installation procedure of the Android app, prompting users to manually ‘Open’ the app after installation.

Moreover, these apps deliberately avoid an icon and cleverly incorporate a UTF-8 character within the app’s label, intensifying their hiding and rendering them more challenging to identify.

This circumstance carries a dual nature, as it represents that if a user ignores to initiate the app post-installation, the probability of it being launched later declines.

After being launched, the app will promptly generate an error message, delivering the user with the following notification:-

“Application is not accessible in your region. Tap OK to uninstall.”