Security researchers have found over 60,000 malicious Android apps. Bitdefender researchers believe that this mobile malware has been thriving undisturbed for an extended period of time in the absence of behavior-based detection capabilities on Android. The report claims that the campaign is designed to aggressively push adware to Android devices with the purpose of driving revenue. However, the threat actors involved can easily switch tactics to redirect users to other types of malware, such as banking Trojans to steal credentials and financial information or ransomware. Researchers claim that they have discovered 60,000 completely different samples (unique apps) carrying the adware and suspect that there are much more in the wild.
Here are some of the types of apps copied by the malware:
* Game cracks
* Games with unlocked features
* Free VPN
* Fake videos
* Netflix
* Fake tutorials
* YouTube/TikTok without ads
* Cracked utility programs like weather, pdf viewers, etc
Not there on Google Play Store
Thankfully, none of these apps are on any official stores. This means that users who download and install third-party apps are at risk. In other situations, the apps simply copied the real ones published in the Google Play Store
“The distribution is organic, as the malware appears when searching for these kinds of apps, mods, cracks, etc. In fact, modded apps are a hot commodity, with websites dedicated entirely to offering these types of packages. Usually, modded apps are modified original applications with their full functionality unlocked or featuring changes to the initial programming,” says the report.
The report also has an example. For example, when the user opens a website from a Google search of a “modded” app, they would be redirected to a random ad page. Sometimes, that page is a download page for malware disguised as a legit download for the mod the user was searching for.