Thursday, March 28, 2024

Beware!! Several Apps on Play Store Delivering Joker, Facestealer & Coper Malware

Typically, users who want to find and install android apps of the highest quality are recommended to rely on Google Play Store as one of the most trusted sources.

In order to prevent fraud in the official Play Store, Google has removed dozens of fraudulent apps. Through the virtual marketplace, these fraudulent apps have been spotted spreading the following malware families like:- 

  • Joker
  • Facestealer
  • Coper

In the latest study conducted by Zscaler ThreatLabz and Pradeo, it was shown that the same pattern is emerging. This malware is still making its way into Google’s official app store, despite the fact that the malware’s traces are regularly modified to avoid detection. 

Although the official app store has been updated to remove some malware, the malware is still present. Joker is a fleeceware that makes the users to subscribe to unwanted paid services, and gathers the following data:-

  • SMS messages
  • Contact lists
  • Device information

Malicious Apps

Two cybersecurity firms have identified a total of 53 Joker downloader apps, which have been downloaded over 330,000 times cumulatively by the two security firms.

Typically, these apps pretend to be something that they are not, like:-

  • SMS
  • Photo editors
  • Blood pressure monitor
  • Emoji keyboards
  • Translation apps

Here below we have listed all the malicious applications:-

  • Simple Note Scanner – com.wuwan.pdfscan
  • Universal PDF Scanner – com.unpdf.scan.read.docscanuniver
  • Private Messenger – com.recollect.linkus
  • Premium SMS – com.premium.put.trustsms
  • Smart Messages – com.toukyoursms.timemessages
  • Text Emoji SMS – messenger.itext.emoji.mesenger
  • Blood Pressure Checker – com.bloodpressurechecker.tangjiang
  • Funny Keyboard – com.soundly.galaxykeyboard
  • Memory Silent Camera – com.silentmenory.timcamera
  • Custom Themed Keyboard – com.custom.keyboardthemes.galaxiy
  • Light Messages – com.lilysmspro.lighting
  • Themes Photo Keyboard – com.themes.bgphotokeyboard
  • Send SMS – exazth.message.send.text.sms
  • Themes Chat Messenger – com.relish.messengers
  • Instant Messenger – com.sbdlsms.crazymessager.mmsrec
  • Cool Keyboard – com.colate.gthemekeyboard
  • Fonts Emoji Keyboard – com.zemoji.fontskeyboard
  • Mini PDF Scanner – com.mnscan.minipdf
  • Smart SMS Messages – com.sms.mms.message.ffei.free
  • Creative Emoji Keyboard – com.whiteemojis.creativekeyboard.ledsloard
  • Fancy SMS – con.sms.fancy
  • Fonts Emoji Keyboard – com.symbol.fonts.emojikeyboards
  • Personal Message – com.crown.personalmessage
  • Funny Emoji Message – com.funie.messagremo
  • Magic Photo Editor – com.amagiczy.photo.editor
  • All Photo Translator – myphotocom.allfasttranslate.transationtranslator
  • Chat SMS – com.maskteslary.messages
  • Smile Emoji – com.balapp.smilewall.emoji
  • Wow Translator – com.imgtop.camtranslator
  • All Language Translate – com.exclusivez.alltranslate
  • Cool Messages – com.learningz.app.cool.messages
  • Blood Pressure Diary – bloodhold.nypressure.mainheart.ratemy.mo.depulse.app.tracker.diary
  • Chat Text SMS – com.echatsms.messageos
  • Hi Text SMS – ismos.mmsyes.message.texthitext.bobpsms
  • Emoji Theme Keyboard – com.gobacktheme.lovelyemojikeyboard
  • iMessager – start.me.messager
  • Text SMS – com.ptx.textsms
  • Camera Translator – com.haixgoback.outsidetext.languagecameratransla
  • Come Messages – com.itextsms.messagecoming
  • Painting Photo Editor – com.painting.pointeditor.photo
  • Rich Theme Message – com.getmanytimes.richsmsthememessenge
  • Quick Talk Message – mesages.qtsms.messenger
  • Advanced SMS – com.fromamsms.atadvancedmmsopp
  • Professional Messenger – com.akl.smspro.messenger
  • Classic Game Messenger – com.classcolor.formessenger.sic
  • Style Message – com.istyle.messagesty
  • Private Game Messages – com.message.game.india
  • Timestamp Camera – allready.taken.photobeauty.camera.timestamp
  • Social Message – com.colorsocial.message
  • Professional Messages – com.adore.attached.message

There is a wide range of malware programs that are developed by the Joker malware authors ranging from extremely complex to the most basic of applications.

The remote nature of these malicious apps is, to a large extent, one of the reasons why they are often unnoticed by antivirus softwares and the Play Store when they are evaluated.

It has also been discovered that Facebook users have been targeted by a type of malware known as Facestealer, found on the Google Play Store.

When a user successfully logs in, the malware author steals both the username and password along with the authentication tokens.

  • Vanilla Camera (cam.vanilla.snapp)
  • Unicc QR Scanner (com.qrdscannerratedx)

Recommendations

Besides the usual rules of thumb when it comes to downloading apps from app stores. Apart from this, users are recommended to follow these mitigations:-

  • Avoid granting unnecessary permissions
  • Verify app legitimacy
  • Always checking for developer information
  • Make sure to read all the reviews
  • Properly check all their privacy policies

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles