Researchers have uncovered a new set of fraudulent Android apps
in the Google Play store that were found to hijack SMS message
notifications for carrying out billing fraud.
The apps in question primarily targeted users in Southwest Asia
and the Arabian Peninsula, attracting a total of 700,000 downloads
before they were discovered and removed from the platform.
The findings were reported independently by cybersecurity firms
Trend Micro[1]
and McAfee[2].
“Posing as photo editors, wallpapers, puzzles, keyboard skins,
and other camera-related apps, the malware embedded in these
fraudulent apps hijack SMS message notifications and then make
unauthorized purchases,” researchers from McAfee said in a Monday
write-up.
The fraudulent apps belong to the so-called “Joker[3]” (aka Bread) malware,
which has been found to repeatedly sneak past Google Play defenses
over the past four years, resulting in Google removing no fewer
than 1,700 infected apps from the Play Store as of early 2020.
McAfee, however, is tracking the threat under a separate moniker
named “Etinu.”
The malware is notorious for perpetrating billing fraud and its
spyware capabilities, including stealing SMS messages, contact
lists, and device information. The malware authors typically employ
a technique called versioning, which refers to uploading a clean
version of the app to the Play Store to build trust among users and
then sneakily adding malicious code at a later stage via app
updates, in a bid to slip through the app review process.
The additional code injected serves as the first-stage payload,
which masquerades seemingly innocuous .PNG files and establishes
with a command-and-control (C2) server to retrieve a secret key
that’s used to decrypt the file to a loader. This interim payload
then loads the encrypted second payload that’s ultimately decrypted
to install the malware.
McAfee’s investigation of the C2 servers revealed users’
personal information, including carrier, phone number, SMS message,
IP address, country, network status, along with auto-renewing
subscriptions.
The list of nine apps is below –
- Keyboard Wallpaper (com.studio.keypaper2021)
- PIP Photo Maker (com.pip.editor.camera)
- 2021 Wallpaper and Keyboard (org.my.favorites.up.keypaper)
- Barber Prank Hair Dryer, Clipper and Scissors
(com.super.color.hairdryer) - Picture Editor (com.ce1ab3.app.photo.editor)
- PIP Camera (com.hit.camera.pip)
- Keyboard Wallpaper (com.daynight.keyboard.wallpaper)
- Pop Ringtones for Android (com.super.star.ringtones)
- Cool Girl Wallpaper/SubscribeSDK (cool.girly.wallpaper)
Users who have downloaded the apps are urged to check for any
unauthorized transactions while also taking steps to watch out for
suspicious permissions requested by apps and carefully scrutinize
apps before they are installed on the devices.
“Judging by how Joker operators repeatedly ensure the malware’s
persistence in Google Play even after being caught numerous times,
most probably there are ways [the operators] are profiting from
this scheme,” Trend Micro researchers said.