Over 200 malicious apps on Google Play downloaded hundreds of thousands of instances

Google Play, the official retailer for Android, distributed over a interval of 1 yr greater than 200 malicious purposes, which cumulatively counted almost eight million downloads.

The information was collected between June 2023 and April 2024 by risk intelligence researchers at Zscaler, who recognized and analyzed malware households each on Google Play and different distribution platforms.

The commonest threats the researchers found on the official Android app retailer embody:

• Joker (38.2%): Information-stealer and SMS message grabber that subscribes victims to premium companies
• Adware (35.9%): Apps that devour web bandwidth and battery to load both intrusive foreground adverts or invisible adverts within the background, producing fraudulent advert impressions
• Facestealer (14.7%): Fb account credential stealers that overlay phishing kinds on high of official social media purposes
• Coper (3.7%): Information-stealer and SMS message interceptor that may additionally carry out keylogging and overlay phishing pages
• Loanly Installer (2.3%)
• Harly (1.4%): Trojan apps that subscribe victims to premium companies
• Anatsa (0.9%): Anatsa (or Teabot) is a banking trojan that targets over 650 purposes of banks worldwide

Earlier this yr in Could, the identical researchers alerted of greater than 90 malicious apps on Google Play, with a obtain rely of 5.5 million.

Though Google has safety mechanisms to detect malicious purposes, risk actors nonetheless have some tips to bypass the verification course of. In a report final yr, the Google Cloud safety crew described the ‘versioning‘, a way that delivers malware by way of utility updates or by loading it from servers managed by the attacker.

Whatever the technique used to ship malware by way of Google Play, some campaigns are extra profitable than others. Whereas Zscaler’s report targeted on Android malware that’s extra widespread, different researchers found campaigns that additionally used Google Play to distribute malware to hundreds of thousands.

In a single case, the Necro malware loader for Android was downloaded 11 million instances by way of simply two apps revealed on the official retailer.

In one other case, the Goldoson Android malware was detected in 60 official apps that cumulatively had 100 million downloads.

Final yr, the SpyLoan was present in apps on Google Play that had been downloaded greater than 12 million instances.

Almost half of the malicious apps that Zscaler ThreatLabz found had been revealed on Google Play underneath instruments, personalization, images, productiveness, and life-style classes.

When it comes to malware blocks tried this yr, Zscaler experiences that the development reveals an total decline, as measured by blocked transactions.

On common, ThreatLabz recorded 1.7 million blocks per 30 days, with 20 million blocks recorded all through the evaluation interval, the most typical threats being Vultur, Hydra, Ermac, Anatsa, Coper, and Nexus.

Zscaler’s cellular threats report additionally reveals a major improve of spyware and adware infections, pushed primarily by SpyLoan, SpinOK, and SpyNote households. Previously yr, the corporate registered 232,000 blocks of spyware and adware exercise.

Probably the most focused nations by cellular malware prior to now yr had been India and america, adopted by Canada, South Africa, and the Netherlands.

In response to the report, cellular malware focused principally the schooling sector, the place the quantity of blocked transactions elevated by 136.8%. The companies sector recorded a 40.9% improve, and chemical substances and mining a 24% improve. All different sectors confirmed a basic decline.

To attenuate the probabilities of getting contaminated by malware from Google Play, customers are suggested to learn opinions from others to see what issues have been reported and test the appliance writer.

Customers must also test the permissions requested at set up time and abort the method if the app requires permissions that don’t match its exercise.

Google has despatched the next remark to BleepingComputer relating to Zscaler’s findings:

“The malicious variations of those apps recognized are not on Play. Android customers are routinely protected in opposition to recognized variations of malware talked about on this report by Google Play Shield, which is on by default on Android gadgets with Google Play Providers.

Google Play Shield can warn customers or block apps recognized to exhibit malicious conduct, even when these apps come from sources outdoors of Play.” – A Google spokesperson