13 fraudulent apps into Google Play have been downloaded 560,000+ times

24.11.2018 securityaffairs Android

Malware researcher discovered 13 fraudulent apps into Google Play that have been already downloaded and installed more than 560,000 times.

Malware researcher Lukas Stefanko from security firm ESET discovered 13 malicious apps into Google Play that have been already downloaded and installed over half a million times (+560,000).

The malicious apps could allow attackers to install another app and trick the user into giving the permissions necessary for the installation.

Lukas Stefanko
@LukasStefanko
· Nov 19, 2018
Don't install these apps from Google Play - it's malware.

Details:
-13 apps
-all together 560,000+ installs
-after launch, hide itself icon
-downloads additional APK and makes user install it (unavailable now)
-2 apps are #Trending
-no legitimate functionality
-reported

View image on Twitter

Lukas Stefanko
@LukasStefanko
App functionality demonstration pic.twitter.com/11HskeD56S

177
3:35 PM - Nov 19, 2018
Twitter Ads info and privacy
Embedded video
73 people are talking about this
Twitter Ads info and privacy
All the malicious apps are posing as games were published by the same developer named Luis O Pinto, at the time they have a low detection rate.

The cybercriminals aim to monetize their efforts pushing unsolicited advertisements to the user when they unlock the device.

Once installed, the malicious apps would remove their icon from the display immediately and downloads other malicious apps in the background.

The applications were all downloaded from a hardcoded address.

In order to trick users into giving permissions to install the downloaded app, the malicious apps attempt to make the user believe that the installation failed and restarted, asking users to approve the action again.

Stefanko reported that the downloaded APK was Game Center, once installed and executed it hides itself start displaying ads.
The expert pointed out that the Game Center requests permissions for full network access and to view network and Wi-Fi connections, and to run at startup.

The malicious apps do not implement specific features, they only work as simple downloaders that can bypass Google Play security checks.

Stefanko confirmed that Game Center is no longer available at the link that is hardcoded in the malicious apps, after being informed of the fraudulent applications Google removed them from Google Play.