You’d think an app listed on the Play Store would be safe to download. That’s what Google wants you to believe, and it’s true to a large extent, but in this digital world, no service is foolproof. Time and time again, there have been instances when widely downloaded apps on the Play Store were infected by malware. While Google continues to promise that the app market is safe, another incident has come to light. Security researchers have discovered a new Trojan malware, called Necro, that not only infects apps downloaded through unofficial sources but also those on the Play Store, including one with more than 10 million downloads.
GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE
How does Necro infect apps
The exact method by which both apps were initially compromised with the malware is still unclear. Researchers at Kaspersky’s Securelist believe that a rogue software development kit (SDK) used for integrating advertising functionalities may be responsible for the breach. SDKs are essential tools that developers use to add specific features to their apps, such as ad services, analytics, or payment processing.
When an SDK is compromised, it can inadvertently introduce vulnerabilities into the applications that utilize it. In this case, the malware affecting the apps displayed ads in the background to generate fraudulent revenue for the attackers, installed apps and APKs without the user’s consent, and used invisible WebViews to interact with paid services.
The trojan in question, Necro, isn’t exactly new. It’s the same malware that infected a popular document scanner called CamScanner in 2019, which at that time had over 100 million downloads.
ANDROID BANKING TROJAN EVOLVES TO EVADE DETECTION AND STRIKE GLOBALLY
Which apps are affected?
Kaspersky researchers identified several apps affected by the Necro Trojan, including those available in Google Play. Their combined audience numbered more than 11 million Android devices.
The first affected app is the Wuta Camera, a photo editing and beautification tool. It has at least 10 million times. The Necro loader has been embedded in it starting from version 6.3.2.148. The latest version of the app, 6.3.6.148, which was available on Google Play, also had it. After the researchers reported the presence of malicious code to Google, the Trojan was removed from the app in version 6.3.7.138.
The second infected app was Max Browser. This browser, according to Google Play, has been installed more than a million times and, starting with version 1.2.0, also contained the Necro loader. Google took down the infected app from the Play Store after it was reported.
Kaspersky also found WhatsApp mods that had the Necro loader in unofficial sources. They also spotted the Spotify mod called “Spotify Plus,” which promises free access to ad-free premium services. Plus, the report mentions mods for popular games like Minecraft, Stumble Guys, Car Parking Multiplayer, and Melon Sandbox, all of which were infected with the Necro loader.
Mods, or modifications, are altered versions of original apps or games that often provide additional features or tweaks.
ANDROID BANKING TROJAN MASQUERADES AS GOOGLE PLAY TO STEAL YOUR DATA
What is Google’s response to this?
Google is aware of the Necro malware and as I mentioned above, it has already taken down the affected apps. A Google spokesperson provided us with the following statement:
All of the malicious versions of the apps identified by this report were removed from Google Play prior to report publication. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.
THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION
4 ways to protect yourself from Necro malware
1) Have strong antivirus software: Android has its own built-in malware protection called Play Protect, but the Necro Trojan proves it’s not enough. Historically, Play Protect hasn’t been 100% foolproof at removing all known malware from Android phones. The best way to protect yourself from clicking malicious links that install malware that may get access to your private information is to have antivirus protection installed on all your devices. This can also alert you of any phishing emails or ransomware scams.
My top pick is TotalAV, and you can get a limited-time CyberGuy readers: $19 your first year (80% off) for the TotalAV Antivirus Pro package.
2) Download apps from reliable sources: It’s important to download apps only from trusted sources like the Google Play Store. You might say I am contradicting myself but Play Store is still safer than other options out there. They have strict checks to prevent malware and other harmful software. However, even with the security measures provided by Google Play, downloading apps from the store does not guarantee 100% protection against malware or harmful software. Avoid downloading apps from unknown websites or unofficial stores, as they can pose a higher risk to your personal data and device. Never trust download links that you get through SMS.
3) Be cautious with app permissions: Always review the permissions requested by apps before installation. If an app requests access to features that seem unnecessary for its function, it could be a sign of malicious intent. Do not give any app Accessibility permissions unless you really need to. Avoid granting permissions that could compromise your personal data.
4) Regularly update your device’s operating system and apps: Keeping your software up to date is crucial, as updates often include security patches for newly discovered vulnerabilities that could be exploited by trojans.
ANDROID USERS AT RISK AS BANKING TROJAN TARGETS MORE APPS
Kurt’s key takeaways
The discovery of the Necro loader in apps like Wuta Camera, Max Browser, and popular game mods shows just how serious security issues can be in the app world. With over 11 million Android devices affected, it’s crucial to be careful about where you download your apps. Unofficial sources can be a breeding ground for hidden threats, but the Play Store isn’t completely safe either. Google should look into what apps it allows on its platform, as I haven’t seen as many malware issues affecting iPhone apps as there are on Android.
Do you think Google does enough to protect users from malware on the Play Store? Let us know in the comments below.
FOR MORE OF MY SECURITY ALERTS, SUBSCRIBE TO MY FREE CYBERGUY REPORT NEWSLETTER HERE