Monday, November 25, 2024
HomeMalwareLightsOut - Malicious Flashlight Apps on Google Play with Nearly 7.5 Million...

LightsOut – Malicious Flashlight Apps on Google Play with Nearly 7.5 Million Downloads

Published on

A new adware spotted in Google play contains scripts to overrides the user decision and disable ads outside of legitimate context. It hides icon which makes the detection and removal process difficult.

The malware Dubbed LightsOut spotted by checkpoint security researchers and notified to Google, who removed the apps from the play store now.The Malware hides into 22 utility and flashlight apps which almost reaches 7.5 million downloads.

Researchers said The deception was far-reaching in its disruption to the user. Some users noted that they were forced to press on ads to answer calls and perform other activities on their device. Indeed, another user reported that the malicious ad activity continued even after he purchased the ad-free version of the app, taking the abuse to a whole new level.

How it works and it’s purpose – LightsOut

It embeds the malicious SDK file into the legitimate Flashlight and utility apps, researchers found multiple malicious capabilities with the samples analyzed.

- Advertisement - SIEM as a Service

Also Read New Android Malware Physically Destroying your Phone by Running Cryptocurrency Miner

The app once launched hides its icon which makes harder for the user to halt the process to remove the app. it offers a control panel to enable or disable services, including the option to disable ads.

Even though users choose to disable ads ‘LightsOut’ overrides it and continues to display the ads out of context.The purpose of the ads is to generate illegal revenue from users.The ad events triggered at the end of the call, Wi-Fi connection, when charger plugged in or the screen is locked.

Researchers said since the ads are not directly connected to ‘LightsOut’s activity, the user is unlikely to understand what caused them. And, even if they do realize the app is to blame, they won’t be able to find the app’s icon and remove it from their device.

Infected Packages on Play store

Package NameDownloads (Min)Downloads (Max)
com.smart.swipe.whitedot50,000100,000
com.wifi.network.realtime10,00050,000
pro.filetrans.app5,00010,000
com.network.guard.tool1,0005,000
com.brightest.ledflashlight1,0005,000
com.arc.voice.recorder.pro1,0005,000
pro.freewifi.password10,00050,000
com.call.recorder.pro100,000500,000
com.solidunion.callrecorder1,000,0005,000,000
com.realtime.app.cleaner10,00050,000
com.nfl.flashlight5,00010,000
hd.background.wallpaper.theme100,000500,000
com.ledflashlight.cool10,00050,000
com.master.wifikey.booster100,000500,000
com.wifimaster.network.speedtest50,000100,000
com.freewifi.connect.booster100,000500,000
com.brightest.ledflashlight.almighty5,00010,000
com.brightest.ledflashlight.best10,00050,000
rec.call.recording.manager1,0005,000
com.smart.freewifi.booster1,0005,000
com.brightest.ledflashlight.pro10,00050,000
com.dr.clean.lite5,00010,000
Total1,585,0007,565,000

SHA-256 Hashes:

f5b98f91c4ccb6f9530434adce285e25e503a7afb6ea97a03bea57c319cd2fbc 52209fa52052b8086ae5213d0a51c053ca07a6f36a131f2627be55db17f39ae7

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

Russian TAG-110 Hacked 60+ Users With HTML Loaded & Python Backdoor

The Russian threat group TAG-110, linked to BlueDelta (APT28), is actively targeting organizations in...