17 apps removed from Play store spotted Joker malware
Google has long been locked in a battle with cybercriminals who create and submit malicious apps to the Play store that somehow sneak past the company's protections. One especially pervasive and problematic piece of malware is the one dubbed Joker, aka Bread. In the latest round, Google was forced to put the kibosh on 17 malicious apps uploaded in September that tried to infect unsuspecting users with the Joker malware.
JOKER IS THE PLAY STORE'S BANE
Google removed six such apps at the start of the month after they've been spotted and reported by security researchers from Pradeo. Before that, in July, Google removed another batch of Joker-infected apps discovered by security researchers from Anquanke. This batch had been active since March and had managed to infect millions of devices.
The firm also mentioned that the Joker malware also steals device information and silently signs up into the victim's smartphone for premium wireless application protocol (WAP) services. This information was given by a Zscaler security researcher who also explained how this virus works until its final stage of billing using the victims' WAP services.
Following its internal procedures, Google removed the apps from the Play Store, used the Play Protect service to disable the apps on infected devices, but users still need to manually intervene and remove the apps from their devices.
The 17 apps included the following:
- All Good PDF Scanner
- Mint Leaf Message-Your Private Message
- Unique Keyboard - Fancy Fonts & Free Emoticons
- Tangram App Lock
- Direct Messenger
- Private SMS
- One Sentence Translator - Multifunctional Translator
- Style Photo Collage
- Meticulous Scanner
- Desire Translate
- Talent Photo Editor - Blur focus
- Care Message
- Part Message
- Paper Doc Scanner
- Blue Scanner
- Hummingbird PDF Converter - Photo to PDF
- All Good PDF Scanner
Some malicious apps contain a stager payload, which retrieves and downloads the final payload URL from the code and then executes it on the infected device. In the latest case, the malicious apps incorporated the stager payload URL directly in their code using encryption or another method to disguise it. The final stage payload then executed the Joker malware. But there were still a total of around 120k+ downloads for the identified malicious apps, as Zscaler noted in a blog post.
Google Pixel 5 prototype leaked online
Related post
0 comments
Leave a reply
Please Login or Register to Comment. Get StartedShare this article
