It Hunts Victims Through Facebook Ads
Android is definitely not a malware-free platform. If you stumble upon the wrong website and download the wrong APK, things can go awry very quickly. But it is generally accepted that by the time you get your apps from the Google Play Store, you should be mostly Free from malware, especially with initiatives like Play Protect, which are supposed to scan for any hidden villains. Still, sometimes the virus makes its way into Google’s firewall and users’ phones. A specific piece of malware, called Autolycos, was being bundled into several popular apps in the Play Store, resulting in it being downloaded more than 3 million times.
ANDROIDpolice video of the day
Security researcher discovered malware Maxim Ingrao (via Bleeping Computer). It was present in at least eight applications, all of which had been removed by Google at the time of writing – although it took the company six months to act from initial acknowledgment of the report.
The way it works is that if left to run, the malware will execute the URL on a remote browser and inject it over HTTP requests instead of loading an external webview. It also requests permission to read SMS content, so infected apps can read your text messages, allowing them to steal things like one-time password codes.
Malicious apps are widely promoted through social media where it reaches users through advertising campaigns, most of them on Facebook. Users are tempted to download them with the promise of keyboard themes, good looking launcher apps and camera apps with great filters. In that regard, they are dominant with two of those apps reaching over a million downloads.
Infected apps, which have all been removed from the Play Store, include:
- Vlog Star Video Editor (com.vlog.star.video.editor, 1 million downloads)
- Creative 3D Launcher (app.launcher.creative3d, 1 million downloads)
- Wow Beauty Camera (com.wowbeauty.camera, 100,000 downloads)
- GIF Emoji Keyboard (com.gif.emoji.keyboard, 100,000 downloads)
- Razer Keyboard and Theme (com.razer.keyboards, 10,000 downloads, not related to gaming/tech company Razer)
- FreeGlow Camera 1.0.0 (com.glow.camera.open, 5,000 downloads)
- Coco Camera v1.1 (com.toomore.cool.camera, 1,000 downloads)
If you (unfortunately) downloaded any of the above apps after seeing a Facebook ad, uninstall it now. Also, don’t download apps with ads, full stop – especially if you don’t know the developer.
