Google Boots Multiple Malware-laced Android Apps from Marketplace

Google has removed 8 apps from its Google Participate in retailer that have been propagating a new variant of the Joker adware, but not prior to they already experienced garnered far more than 3 million downloads.

French security researcher Maxime Ingrao of cybersecurity company Evina learned a malware that he dubbed Autolycos that can subscribe buyers to a quality assistance as properly as accessibility users’ SMS messages,. in accordance to a submit he manufactured on Twitter past week. This form of malware–in which destructive apps subscribe customers to premium expert services without their know-how or consent to rack up payment charges–is named toll fraud malware, or additional generally, fleeceware.

[FREE On-demand Event: Join Keeper Security’s Zane Bond in a Threatpost roundtable and learn how to securely access your machines from anywhere and share sensitive documents from your home office. WATCH HERE.]

Ingrao claimed he found out eight programs on the web page spreading Autolycos given that June 2021 that experienced racked up various million downloads. The cybercriminals behind Autolycos are working with Facebook web pages and working adverts on Facebook and Instagram to market the malware, he mentioned.

“For case in point, there had been 74 advert campaigns for Razer Keyboard & Theme malware,” Ingrao tweeted in one particular of a sequence of comply with-up posts describing how the malware performs.

Joker Rides All over again

Ingrao when compared the malware to Joker, a spy ware identified in 2019 that also secretly subscribed persons to premium services and stole SMS messages, among other nefarious things to do.

Indeed, on further evaluation, researchers from Malwarebytes believe the malware is a new variant of Joker–what Malwarebytes refers to as “Android/Trojan.Spy.Joker–Malwarebytes intelligence researcher Pieter Artnz reported in a post published a day immediately after Ingrao’s revelation.

Joker was the initial main malware families hat specialised in in fleeceware, in accordance to Malwarebytes. The trojan would hide in the ad frameworks used by the destructive apps propagating it these frameworks combination and provide in-app ads.

After the apps with Joker were installed, they would show a “splash” display screen, which would show the app symbol, to toss off victims while doing numerous destructive processes in the background, these as thieving SMSes and contact lists as perfectly as carrying out advert fraud and signing individuals up for subscriptions without their awareness.

Difference in Execution

Just one variation among the original Joker and Autolycos, even so, was pointed out by Ingrao.”No webview like #Joker but only http requests,” he tweeted.

“It retrieves a JSON (Java Script Object Notation) on the C2 handle: 68.183.219.190/For every/y,” Ingrao explained of Autolycos in a tweet. “It then executes the URLs, for some actions it executes the URLs on a distant browser and returns the consequence to involve it in the requests.”

Malwarebytes’ Artnz also explained this big difference additional in his put up. While Joker applied webviews—or a piece of Web information, these types of as “a tiny component of the application screen, a full webpage, or something in between”—to do its filthy week, Autolycos avoids this by executing URLs on a remote browser and then including the result in HTTP requests, he wrote.

This helps Autolycos evade detection even extra adeptly than the first Joker, according to Malwarebytes’ Artnz said. “Not demanding a WebView tremendously cuts down the chances that the person of an impacted unit notices a little something fishy is heading on,” he wrote.

Lag Time in Discovery and App Removing

The 8 applications in which Ingrao found Autolycos are:

• Vlog Star Video Editor (com.vlog.star.video.editor) – 1 million downloads
• Imaginative 3D Launcher (app.launcher.innovative3d) – 1 million downloads
• Wow Beauty Camera (com.wowbeauty.camera) – 100,000 downloads
• Gif Emoji Keyboard (com.gif.emoji.keyboard) – 100,000 downloads
• Freeglow Digital camera 1.. (com.glow.camera.open) – 5,000 downloads
• Coco Digicam v1.1 (com.toomore.great.camera) –  1,000 downloads
• Amusing Camera by KellyTech –  500,000 downloads
• Razer Keyboard & Topic by rxcheldiolola – 50,000 downloads.

When Ingrao found out the offending applications in July 2021 and described them to Google swiftly, he explained to BleepingComputer that the company took six months to clear away 6 of the applications. Also, Google only lastly eliminated the previous two on July 13, in accordance to Malwarebytes.

Artnz was critical of the lag time among discovery and removing, even though he did not speculate as to the rationale why, noting only that “the little footprint and masked utilization of APIs should make it difficult to come across destructive apps among the multitude of applications that can be discovered in the Google Play Store.”

“It’s attainable [the malicious apps] would still be available if the researcher hadn’t long gone community since he stated he received tired of waiting around,” Artnz wrote.

Google did not straight away reply to request for comment on Monday. In fact, the company has a storied history of struggling to maintain malicious apps—in certain fleeceware–off its cell application keep for the Android system.

[FREE On-demand Event: Join Keeper Security’s Zane Bond in a Threatpost roundtable and learn how to securely access your machines from anywhere and share sensitive documents from your home office. WATCH HERE.]