Eight ‘dangerous’ apps have been found on Google Play Store that could drain your bank account and even bypass two-factor authentication.

 

Cybersecurity experts have uncovered dangerous apps that steal your info right under your nose.

 

They have revealed a long list of malicious apps that can steal your bank info – and have been installed by tens of thousands of users.

 

Tech security firm ESET says all of the apps have now been removed from the Google Play Store, but phone users will need to delete them manually.

 

The dangerous apps “masquerade” as device boosters and cleaners, battery managers and horoscope apps – but they’re actually eleborate hacking tools.

 

Malware authors keep testing the vigilance of Android users by sneaking disguised mobile banking Trojans into the Google Play Store,” wrote ESET’s Lukas Stefanko.

 

“They can intercept and redirect text messages to bypass SMS-based two-factor authentication, intercept call logs, and download and install other apps on the compromised device.”

 

By sending and receiving texts from your device, it’s possible for hackers to gain access to almost any of your web accounts.

 

This could put your social media profiles, banking apps and gaming accounts at risk.

 

When the apps are launched, they display a fake error message that says they’ve been removed because of incompatibility with your device.

 

The app will then hide itself, or sometimes pretend to function normally.

 

But behind the scenes, the app will send and read text messages, impersonate banking apps, and even download and install other applications.

 

Researchers on Tuesday published a serious warning for Android device owners, alerting them to the discovery of eight dangerous apps in the Google Play Store that could have allowed an attacker to take over a victim’s smartphone as well as drain their bank account.

 

That’s according to Check Point Research, which said in its report about the discovery that the cyber threat intelligence firm actually found the apps back on January 27 and notified Google about them the next day. One month ago today, Google confirmed that they’d been removed from the Play Store — but you still need to remove any of these from your device yourself, if you have them. So, what exactly happened here? Read on for the details, as well as the names of all eight of the identified Android apps.

 

The Check Point researchers explained that what they discovered is a malware dropper, called “Clast82,” which was spreading via the eight apps. What’s scary about it is that the dropper was able to avoid being caught by Google Play Protect, and it also includes a remote access trojan so nasty that one of the researchers told Forbes it lets the attacker take “full control over a victim’s phone — making it as if the hacker is holding the phone physically.”

 

According to the Check Point findings, this particular dropper seems to prefer the AlienBot Malware-as-a-Service (MaaS), which lets an attacker remotely inject malicious code into legitimate financial applications on Android devices. “The attacker obtains access to victims’ accounts, and eventually completely controls their device,” the researchers explain. “Upon taking control of a device, the attacker has the ability to control certain functions, just as if they were holding the device physically, like installing a new application on the device, or even control it with TeamViewer.”

 

The eight apps in question, along with their package names, are as follows, per Check Point Research:

 

  1. Cake VPN (com.lazycoder.cakevpns)
  2. Pacific VPN (com.protectvpn.freeapp)
  3. eVPN (com.abcd.evpnfree)
  4. BeatPlayer (com.crrl.beatplayers)
  5. QR/Barcode Scanner MAX (com.bezrukd.qrcodebarcode)
  6. Music Player (com.revosleap.samplemusicplayers)
  7. tooltipnatorlibrary (com.mistergrizzlys.docscanpro)
  8. QRecorder (com.record.callvoicerecorder)

 

Again, you should absolutely delete any of these apps immediately if you find them on your device. It would probably also be a good idea to change any passwords associated with your financial accounts, too, since accessing those is one of the worries here.

 

While hackers can be quite clever and creative in the degree to which they’ll go to hide the intentions and true nature of their apps, this is yet another opportunity to be reminded that you should always double-check the apps you’re preparing to download and the identity of the developers behind them. It doesn’t appear to be a situation where the apps above were able to infect millions of devices before researchers caught on to them — this time. But hackers who are truly committed will keep coming back, undaunted, until they score.

 

Cybersecurity experts warn over these Android apps

The following apps were listed as being ‘compromised’:

 

  • Power Manager
  • Astro Plus
  • Master Cleaner – CPU Booster
  • Master Clean – Power Booster
  • Super Boost Cleaner
  • Super Fast Cleaner
  • Daily Horoscope For All Zodiac Signs
  • Phone Booster – Clean Master
  • Speed Cleaner – CPU Cooler
  • Ultra Phone Booster
  • Free Daily Horoscope 2019
  • Free Daily Horoscope Plus – Astrology Online
  • Phone Power Booster
  • Ultra Cleaner – Power Boost
  • Master Cleaner – CPU Booster
  • Daily Horoscope – Astrological Forecast
  • Speed Cleaner – CPU Cooler
  • Horoscope 2018
  • Meu Horóscopo
  • Master Clean – Power Booster
  • Boost Your Phone
  • Phone Cleaner – Booster, Optimizer
  • Clean Master Pro Booster 2018
  • Clean Master – Booster Pro
  • BoostFX.Android cleaner
  • Daily Horoscope
  • Personal Horoscope

 

How to stay safe

According to ESET, it’s possible to fix your issues by simply uninstalling the apps.

 

You can do this by heading to Settings > General > Application manager / Apps.

 

 

However, if any third-party services have been compromised, you’ll need to change your passwords on those accounts manually.

 

It’s worth checking your bank for suspicious transactions, too.

 

 

BGR, TheSun


Leave a Reply