{"id":19984,"date":"2022-07-20T08:09:46","date_gmt":"2022-07-20T08:09:46","guid":{"rendered":"https:\/\/harchi90.com\/google-pulls-malware-infected-apps-3-million-users-at-risk-the-register\/"},"modified":"2022-07-20T08:09:46","modified_gmt":"2022-07-20T08:09:46","slug":"google-pulls-malware-infected-apps-3-million-users-at-risk-the-register","status":"publish","type":"post","link":"https:\/\/harchi90.com\/google-pulls-malware-infected-apps-3-million-users-at-risk-the-register\/","title":{"rendered":"Google pulls malware-infected apps, 3 million users at risk \u2022 The Register"},"content":{"rendered":"
\n

Google pulled 60 malware-infected apps from its Play Store, installed by more than 3.3 million punters, that can be used for all kinds of criminal activities including credential theft, spying and even stealing money from victims.<\/p>\n

Zscaler’s ThreatLabZ and security researcher Maxime Ingrao from fraud protection firm Evina discovered the downloader apps stuffed with software nasties including Joker, Facestealer, Coper, and Autolycos malware \u2014 the latter is a new family, according to Ingrao, who named and discovered<\/a> Autolycos in eight different apps with more than three million downloads to Android devices.<\/p>\n

The new malware strain, similar to Joker, steals SMS messages when downloaded and also unwittingly subscribes users to \u2014 and charges them for using \u2014 premium wireless application protocol services, Ingrao tweeted<\/a>. <\/p>\n

\n

Found new family of malware that subscribe to premium services \ud83d\udc408 applications since June 2021, 2 apps always in Play Store, +3M installs \ud83d\udc80\ud83d\udc80No webview like #Joker<\/a> but only http requestsLet’s call it #autolycos<\/a> \ud83d\udc7e#Android<\/a> #malware<\/a> #evina<\/a> pic.twitter.com\/SgTfrAOn6H<\/a><\/p>\n

\u2014 Maxime Ingrao (@IngraoMaxime) July 13, 2022<\/a><\/p><\/blockquote>\n

This spyware is designed to steal SMS messages, contact lists, and device information, and to sign the victim up for premium wireless application protocol (WAP) services.<\/p>\n

“It retrieves a JSON on the C2 address: 68.183.219.190\/pER\/y,” he further explained. “It then executes the urls, for some steps it executes the urls on a remote browser and returns the result to include it in the requests. This allows it not to have a Webview and to be more discreet.”<\/p>\n

\n