android

Cybersecurity researchers have discovered adware and information-stealing malware on the Google Play Store last month, with at least five still available and having amassed over two million downloads.

Adware infections displaying unwanted advertisements that can be particularly intrusive, degrade the user experience, deplete the battery, generate heat, and even cause unauthorized charges.

This software generally tries to hide by masquerading as something else on the host device and makes money for remote operators by forcing the victim to perform views or clicks on affiliated advertisements.

However, information-stealing Trojans are far more nefarious, stealing login credentials for other sites you frequent, including your social media and online banking accounts.

Infiltrating the Google Play Store

Analysts at Dr. Web antivirus report that adware apps and data-stealing Trojans were among the most prominent Android threats in May 2022.

At the top of the report are spyware apps that can steal information from other apps' notifications, primarily to snatch one-time 2FA passcodes (OTP) and take over accounts.

Among the many threats that managed to infiltrate the Google Play Store, the following five are still available:

  • PIP Pic Camera Photo Editor – 1 million downloads, malware masquerading as image-editing software, but which steals the Facebook account credentials of its users.
  • Wild & Exotic Animal Wallpaper – 500,000 downloads, an adware trojan that replaces its icon and name to 'SIM Tool Kit' and adds itself to the battery-saving exceptions list.
  • ZodiHoroscope – Fortune Finder – 500,000 downloads, malware that steal Facebook account credentials by tricking users into entering them, supposedly to disable in-app ads.
  • PIP Camera 2022 – 50,000 downloads, camera effects app that is also a Facebook account hijacker.
  • Magnifier Flashlight – 10,000 downloads, adware app that serves videos and static banner ads.
Three malicious applications still on the Play Store
Three malicious applications still available on the Play Store

Bleeping Computer has contacted Google to inform them about the above applications and verify if the existing versions were cleaned and resubmitted or are still as dangerous as described in Dr. Web's report.

However, judging from recent user reviews, these apps are still demonstrating malicious functionality and don't deliver on their features promises.

Recent user reviews for PIP Pic Camera Photo Editor
Recent user reviews for PIP Pic Camera Photo Editor (Play Store)

Other applications spotted by Dr. Web's antivirus team on the Play Store in May 2022 include a racing game, a deleted image recovery tool, a fake state compensation app targeting Russian users, and a "free access" app for the Only Fans platform.

Fake game app that pushed advertisments
Fake game app that pushed advertisements (Dr. Web)

These apps have since been removed from the Play Store, but users who installed them on their devices need to remove them and also run a full AV scan to uproot any remnants as well.

Hydra malware infiltration

Researchers at Cyble have also spotted the Hydra banking trojan on the Google Play Store, recently observed targeting banking customers in Europe.

The malware masqueraded as a PDF document manager with text to PDF and QR code scanning features and amassed 10,000 downloads.

Hydra hiding in a PDF manager app on the Play Store
Hydra hiding in a PDF manager app on the Play Store (Cyble)

Cyble told Bleeping Computer that the malicious app was on the Play Store until June 9, 2022, but Google has since removed it.

However, the same PDF app is still available on third-party stores like APKAIO.com and APKCombo.com, so beware.

Related Articles:

Infostealer malware logs used to identify child abuse website members

New Unfurling Hemlock threat actor floods systems with malware

Snowblind malware abuses Android security feature to bypass security

New Medusa malware variants target Android users in seven countries

Fake Google Chrome errors trick you into running malicious PowerShell scripts