Monday, April 28, 2025
HomeAndroidMalicious Android Dropper App 'Xhelper' Reinstall Itself after Uninstall - Infected 45K...

Malicious Android Dropper App ‘Xhelper’ Reinstall Itself after Uninstall – Infected 45K Devices

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed a persistent malicious Android dropper app dubbed XHelper capable of reinstalling itself again if users uninstalled from the devices.

The malicious app is persistent, once the app installed it hides and downloads other malware, displays pop-up ads. The malware found to be downloaded from unknown sources, not available with Google play.

Android Trojan xHelper

The malware was spotted in earlier May and slowly it climbs to the list of top 10 mobile malware, it targets Android users by masquerade the name of legitimate apps.

- Advertisement - Google News

Threat actors behind XHelper malware primarily target the Android users in India, the U.S., and Russia. The malicious app infects more than 45,000 devices in the past six months.

Several users complained about the XHelper malware on various online forums, states that “antivirus app didn’t detect it”.

XHelper
XHelper User Review

According to Symantec analysis, the “XHelper doesn’t have a regular user interface, it is an application component and it won’t be listed in the device’s application launcher. This makes malware more stealthy and performs its malicious activities undercover.”

The mysterious malware cannot be launched manually as it has no available icons, it initiates automatically under certain external events such as the device “connected to or disconnected from a power supply, the device is rebooted, or an app is installed or uninstalled.”

“Once launched, the malware will register itself as a foreground service, lowering its chances of being killed when memory is low and connect’s to attackers C&C server and wait for commands. To avoid communication interception SSL certificate pinning is used.”

Earlier Malwarebytes noted that the xHelper malware has Full-stealth & semi-stealth versions. Both the versions hide from the App launcher, the only difference is that the semi-stealth version creates icon “xHelper” in notifications, the full-stealth version deletes all traces.

xHelper
semi-stealth version

With full-stealth version, the xHelper appears only in-app info section.

xHelper
Full-Stealth Version

Once it successfully installed in the device it communicates wit C&C and capable of downloading droppers, clickers, and rootkits to the compromised device.

Researchers believe the development of the app still in progress and they suspect, the attackers may target users of India’s largest 4G network by masquerading the Jio app.

Some users said that they suppressed Xhelper activity by turning off permissions and locking them using app lock software. Some users said that “tried denying permissions to xHelper without uninstalling, but it turned on all permissions again.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

New iOS Vulnerability Could Brick iPhones with Just One Line of Code

A security researcher has uncovered a critical vulnerability in iOS, Apple's flagship mobile operating...

Cybercriminals Selling Sophisticated HiddenMiner Malware on Dark Web Forums

Cybercriminals have begun openly marketing a powerful new variant of the HiddenMiner malware on...

Three IXON VPN Client Vulnerabilities Let Attackers Escalate Privileges

Security researchers at Shelltrail have discovered three significant vulnerabilities in the IXON VPN client...

Cybersecurity Firm CEO Arrested for Planting Malware in Hospital Systems

Jeffrey Bowie, the CEO of a local cybersecurity firm, has been arrested for allegedly...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Cybercriminals Selling Sophisticated HiddenMiner Malware on Dark Web Forums

Cybercriminals have begun openly marketing a powerful new variant of the HiddenMiner malware on...

North Korean APT Hackers Pose as Companies to Spread Malware to Job Seekers

Silent Push Threat Analysts have uncovered a chilling new cyberattack campaign orchestrated by the...

Russian VPS Servers With RDP and Proxy Servers Enable North Korean Cybercrime Operations

Trend Research has uncovered a sophisticated network of cybercrime operations linked to North Korea,...