Categories: AndroidMalware

Beware!! Several Apps on Play Store Delivering Joker, Facestealer & Coper Malware

Typically, users who want to find and install android apps of the highest quality are recommended to rely on Google Play Store as one of the most trusted sources.

In order to prevent fraud in the official Play Store, Google has removed dozens of fraudulent apps. Through the virtual marketplace, these fraudulent apps have been spotted spreading the following malware families like:- 

  • Joker
  • Facestealer
  • Coper

In the latest study conducted by Zscaler ThreatLabz and Pradeo, it was shown that the same pattern is emerging. This malware is still making its way into Google’s official app store, despite the fact that the malware’s traces are regularly modified to avoid detection. 

Although the official app store has been updated to remove some malware, the malware is still present. Joker is a fleeceware that makes the users to subscribe to unwanted paid services, and gathers the following data:-

  • SMS messages
  • Contact lists
  • Device information

Malicious Apps

Two cybersecurity firms have identified a total of 53 Joker downloader apps, which have been downloaded over 330,000 times cumulatively by the two security firms.

Typically, these apps pretend to be something that they are not, like:-

  • SMS
  • Photo editors
  • Blood pressure monitor
  • Emoji keyboards
  • Translation apps

Here below we have listed all the malicious applications:-

  • Simple Note Scanner – com.wuwan.pdfscan
  • Universal PDF Scanner – com.unpdf.scan.read.docscanuniver
  • Private Messenger – com.recollect.linkus
  • Premium SMS – com.premium.put.trustsms
  • Smart Messages – com.toukyoursms.timemessages
  • Text Emoji SMS – messenger.itext.emoji.mesenger
  • Blood Pressure Checker – com.bloodpressurechecker.tangjiang
  • Funny Keyboard – com.soundly.galaxykeyboard
  • Memory Silent Camera – com.silentmenory.timcamera
  • Custom Themed Keyboard – com.custom.keyboardthemes.galaxiy
  • Light Messages – com.lilysmspro.lighting
  • Themes Photo Keyboard – com.themes.bgphotokeyboard
  • Send SMS – exazth.message.send.text.sms
  • Themes Chat Messenger – com.relish.messengers
  • Instant Messenger – com.sbdlsms.crazymessager.mmsrec
  • Cool Keyboard – com.colate.gthemekeyboard
  • Fonts Emoji Keyboard – com.zemoji.fontskeyboard
  • Mini PDF Scanner – com.mnscan.minipdf
  • Smart SMS Messages – com.sms.mms.message.ffei.free
  • Creative Emoji Keyboard – com.whiteemojis.creativekeyboard.ledsloard
  • Fancy SMS – con.sms.fancy
  • Fonts Emoji Keyboard – com.symbol.fonts.emojikeyboards
  • Personal Message – com.crown.personalmessage
  • Funny Emoji Message – com.funie.messagremo
  • Magic Photo Editor – com.amagiczy.photo.editor
  • All Photo Translator – myphotocom.allfasttranslate.transationtranslator
  • Chat SMS – com.maskteslary.messages
  • Smile Emoji – com.balapp.smilewall.emoji
  • Wow Translator – com.imgtop.camtranslator
  • All Language Translate – com.exclusivez.alltranslate
  • Cool Messages – com.learningz.app.cool.messages
  • Blood Pressure Diary – bloodhold.nypressure.mainheart.ratemy.mo.depulse.app.tracker.diary
  • Chat Text SMS – com.echatsms.messageos
  • Hi Text SMS – ismos.mmsyes.message.texthitext.bobpsms
  • Emoji Theme Keyboard – com.gobacktheme.lovelyemojikeyboard
  • iMessager – start.me.messager
  • Text SMS – com.ptx.textsms
  • Camera Translator – com.haixgoback.outsidetext.languagecameratransla
  • Come Messages – com.itextsms.messagecoming
  • Painting Photo Editor – com.painting.pointeditor.photo
  • Rich Theme Message – com.getmanytimes.richsmsthememessenge
  • Quick Talk Message – mesages.qtsms.messenger
  • Advanced SMS – com.fromamsms.atadvancedmmsopp
  • Professional Messenger – com.akl.smspro.messenger
  • Classic Game Messenger – com.classcolor.formessenger.sic
  • Style Message – com.istyle.messagesty
  • Private Game Messages – com.message.game.india
  • Timestamp Camera – allready.taken.photobeauty.camera.timestamp
  • Social Message – com.colorsocial.message
  • Professional Messages – com.adore.attached.message

There is a wide range of malware programs that are developed by the Joker malware authors ranging from extremely complex to the most basic of applications.

The remote nature of these malicious apps is, to a large extent, one of the reasons why they are often unnoticed by antivirus softwares and the Play Store when they are evaluated.

It has also been discovered that Facebook users have been targeted by a type of malware known as Facestealer, found on the Google Play Store.

When a user successfully logs in, the malware author steals both the username and password along with the authentication tokens.

  • Vanilla Camera (cam.vanilla.snapp)
  • Unicc QR Scanner (com.qrdscannerratedx)

Recommendations

Besides the usual rules of thumb when it comes to downloading apps from app stores. Apart from this, users are recommended to follow these mitigations:-

  • Avoid granting unnecessary permissions
  • Verify app legitimacy
  • Always checking for developer information
  • Make sure to read all the reviews
  • Properly check all their privacy policies

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

10 Best Penetration Testing Companies in 2025

Penetration testing companies play a vital role in strengthening the cybersecurity defenses of organizations by…

5 hours ago

Lumma Stealer Using Fake Google Meet & Windows Update Sites to Launch “Click Fix” Style Attack

Cybersecurity researchers continue to track sophisticated "Click Fix" style distribution campaigns that deliver the notorious…

9 hours ago

Fake BianLian Ransom Demands Sent via Physical Letters to U.S. Firms

In a novel and concerning development, multiple U.S. organizations have reported receiving suspicious physical letters…

22 hours ago

Strela Stealer Malware Attack Microsoft Outlook Users for Credential Theft

The cybersecurity landscape has recently been impacted by the emergence of the Strela Stealer malware,…

22 hours ago

New PyPI Malware Targets Developers to Steal Ethereum Wallets

A recent discovery by the Socket Research Team has unveiled a malicious PyPI package named…

22 hours ago

Threat Actors Exploit PHP-CGI RCE Vulnerability to Attack Windows Machines

A recent cybersecurity threat has emerged where unknown attackers are exploiting a critical remote code…

22 hours ago