4 Malicious apps on Play Store totaled +1M downloads

Four malicious Android apps uploaded by the same developer to Google Play totaled at least one million downloads.

Malwarebytes researchers discovered four malicious apps uploaded by the same developer (Mobile apps Group) to the official Google Play. The apps are infected with the Android/Trojan.HiddenAds.BTGTHB malware, the apps totaled at least one million downloads.

Below is the list of the apps:

Bluetooth App Sender (com.bluetooth.share.app). 50,000+ downloads
Bluetooth Auto Connect (com.bluetooth.autoconnect.anybtdevices). 1,000,000+ downloads
Driver: Bluetooth, Wi-Fi, USB (com.driver.finder.bluetooth.wifi.usb). 10,000+ downloads
Mobile transfer: smart switch (com.mobile.faster.transfer.smart.switch). 1,000+ downloads

The researchers pointed out that older versions of the same apps have been detected in the past as different variants of Android/Trojan.HiddenAds.

The apps were used as part of an adware campaign redirecting victims to websites under the control of the attackers. Some of the sites employed in the campaign host phishing pages.

“After the initial delay, the malicious app opens phishing sites in Chrome. The content of the phishing sites varies—some are harmless sites used simply to produce pay-per-click, and others are more dangerous phishing sites that attempt to trick unsuspecting users. For example, one site includes adult content that leads to phishing pages that tell the user they’ve been infected, or need to perform an update.” reads the post published by Malwarebytes. “The Chrome tabs are opened in the background even while the mobile device is locked. When the user unlocks their device, Chrome opens with the latest site.”

Some websites were also designed to prompt users to install cleaner apps on their mobile devices and deliver additional malicious payloads.

In order to avoid detection, the malicious apps wait for some days before opening a phishing site in the Chrome browser, and then launch more tabs every two hours.

“It’s unclear if that means to wait an additional two hours after the first ad delay, or display another ad two hours after the first ad.” continues the report. “Regardless, it is another example of using delays to obfuscate detection. These type of log entries are recorded every fifteen minutes, constantly setting new time released ads.”

Malwarebytes researchers believe the apps are part of a malware operation called HiddenAds, which dates back at least since June 2019.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Android apps)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.