Android antivirus apps caught spreading their own malware

Date:
Thu, 07 Apr 2022 15:49:25 +0000

Description:
Six fake antivirus apps have been removed from the Google Play Store.

FULL STORY ======================================================================

Google has removed a number of fake Android antivirus apps from the Play
Store after it was discovered they were being used as a vehicle for malware distribution.

According to cybersecurity experts from Check Point Research, the company responsible for the discovery, at least half a dozen antivirus apps available on the official Android marketplace were being used to spread banking
malware.

The apps in question are called: Atom Clean-Booster, Antivirus Antivirus, Super Cleaner Alpha Antivirus, Cleaner Powerful Cleaner, Antivirus Center Security - Antivirus (two versions)

These malicious apps were carrying Sharkbot, a malware strain that steals passwords and banking information. It shares push notifications and offers up fake login prompts, through which users share their credentials with the attackers.

Although all have since been removed from the Play Store, Check Point says they still remain active in unofficial markets. Android users who had downloaded the apps before they were removed are advised to uninstall them immediately. TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a 100 Amazon gift card (or equivalent in USD). Thank you for taking part.

Click here to start the survey in a new window << Sparing Russians and the Chinese

In a single week of analysis, more than 1,000 unique infected endpoints were identified, with the number growing by roughly 100 every day. Google Play Store figures show the malicious apps were downloaded roughly 11,000 times in total.

The threat actors identity remains unknown, although the researchers say they have reason to believe they are of Russian origin. The malware comes with geo-fencing features, ignoring devices in China, India, Romania, Russia, Ukraine, and Belarus. Most of the victims are located in the UK and Italy.

The developer accounts that uploaded the apps were Zbynek Adamcik, Adelmio Pagnotto and Bingo Like Inc. Of the three accounts, two have been active
since the autumn of 2021. Read more

That Android antivirus could actually be malware

Hundreds of thousands of Android users infected by banking malware hosted

on Play Store

This dangerous Android banking trojan is now available online for anyone

to use

Simply downloading the app wont be enough for the threat actors to launch a full-blown attack, however. The victim still needs to grant the app permissions for accessibility services, which is something the app will try and trick the victim into doing.

After the app is granted the permissions, it will take over most of the smartphones functions and will be able to operate freely. Shield against scammers with the best ID theft protection services right now



======================================================================
Link to news story: https://www.techradar.com/news/android-antivirus-apps-caught-spreading-their-o wn-malware/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)