Another day, another batch of Android apps that made it into the Google Play Store—accumulating hundreds of thousands of downloads—with some sneaky malware embedded in their code.
This time around, the malware is called “Joker.” As Aleksejs Kuprins writes over at the cybersecurity company CSIS, this particular malware is designed to silently sign users up for subscription services, something they might not even notice they did unless they’re diligent in checking their monthly credit card statements.
He describes:
“For example, in Denmark, Joker can silently sign the victim up for a 50 DKK/week service (roughly ~6,71 EUR). This strategy works by automating the necessary interaction with the premium offer’s webpage, entering the operator’s offer code, then waiting for a SMS message with a confirmation code and extracting it using regular expressions. Finally, the Joker submits the extracted code to the offer’s webpage, in order to authorize the premium subscription.”
While Google has since removed the offending apps from the Google Play store, they managed to rack up more than 472,000 total downloads before their excommunication. If you have any of these apps installed on your own Android phone or tablet—or, worse, you actively use them—it’s time to delete them ASAP. (We’ve provided links so you can confirm the app on your device is the one to get rid of; obviously, do not sideload these apps onto your Android.)
installed on your own Android phone or tablet—or, worse, you actively use them—it’s time to delete them ASAP. (We’ve provided links so you can confirm the app on your device is the one to get rid of; obviously, do not sideload these apps onto your Android.)
- Advocate Wallpaper
- Age Face
- Altar Message
- Antivirus Security - Security Scan
- Beach Camera
- Board picture editing
- Certain Wallpaper
- Climate SMS
- Collate Face Scanner
- Cute Camera
- Dazzle Wallpaper
- Declare Message
- Display Camera
- Great VPN
- Humour Camera
- Ignite Clean
- Leaf Face Scanner
- Mini Camera
- Print Plant scan
- Rapid Face Scanner
- Reward Clean
- Ruddy SMS
- Soby Camera
- Spark Wallpaper
If you have used any of these apps, it’s worth checking your Google Play account for any unexpected subscriptions, though we doubt you’ll find anything there. Instead, you’ll want to take a peek at your credit card or bank statements as far back as June of this year, which is when the Joker malware started kicking off its latest batch of auto-subscriptions. You might also want to let your contacts know that you were potentially infected, as Joker pilfers your entire contact list and uploads it to a command and control server.
Source: lifehacker.com