Beware!! Several Apps on Play Store Delivering Joker, Facestealer & Coper Malware

Typically, users who want to find and install android apps of the highest quality are recommended to rely on Google Play Store as one of the most trusted sources.

In order to prevent fraud in the official Play Store, Google has removed dozens of fraudulent apps. Through the virtual marketplace, these fraudulent apps have been spotted spreading the following malware families like:- 

  • Joker
  • Facestealer
  • Coper

In the latest study conducted by Zscaler ThreatLabz and Pradeo, it was shown that the same pattern is emerging. This malware is still making its way into Google’s official app store, despite the fact that the malware’s traces are regularly modified to avoid detection. 

Although the official app store has been updated to remove some malware, the malware is still present. Joker is a fleeceware that makes the users to subscribe to unwanted paid services, and gathers the following data:-

  • SMS messages
  • Contact lists
  • Device information

Malicious Apps

Two cybersecurity firms have identified a total of 53 Joker downloader apps, which have been downloaded over 330,000 times cumulatively by the two security firms.

Typically, these apps pretend to be something that they are not, like:-

  • SMS
  • Photo editors
  • Blood pressure monitor
  • Emoji keyboards
  • Translation apps

Here below we have listed all the malicious applications:-

  • Simple Note Scanner – com.wuwan.pdfscan
  • Universal PDF Scanner – com.unpdf.scan.read.docscanuniver
  • Private Messenger – com.recollect.linkus
  • Premium SMS – com.premium.put.trustsms
  • Smart Messages – com.toukyoursms.timemessages
  • Text Emoji SMS – messenger.itext.emoji.mesenger
  • Blood Pressure Checker – com.bloodpressurechecker.tangjiang
  • Funny Keyboard – com.soundly.galaxykeyboard
  • Memory Silent Camera – com.silentmenory.timcamera
  • Custom Themed Keyboard – com.custom.keyboardthemes.galaxiy
  • Light Messages – com.lilysmspro.lighting
  • Themes Photo Keyboard – com.themes.bgphotokeyboard
  • Send SMS – exazth.message.send.text.sms
  • Themes Chat Messenger – com.relish.messengers
  • Instant Messenger – com.sbdlsms.crazymessager.mmsrec
  • Cool Keyboard – com.colate.gthemekeyboard
  • Fonts Emoji Keyboard – com.zemoji.fontskeyboard
  • Mini PDF Scanner – com.mnscan.minipdf
  • Smart SMS Messages – com.sms.mms.message.ffei.free
  • Creative Emoji Keyboard – com.whiteemojis.creativekeyboard.ledsloard
  • Fancy SMS – con.sms.fancy
  • Fonts Emoji Keyboard – com.symbol.fonts.emojikeyboards
  • Personal Message – com.crown.personalmessage
  • Funny Emoji Message – com.funie.messagremo
  • Magic Photo Editor – com.amagiczy.photo.editor
  • All Photo Translator – myphotocom.allfasttranslate.transationtranslator
  • Chat SMS – com.maskteslary.messages
  • Smile Emoji – com.balapp.smilewall.emoji
  • Wow Translator – com.imgtop.camtranslator
  • All Language Translate – com.exclusivez.alltranslate
  • Cool Messages – com.learningz.app.cool.messages
  • Blood Pressure Diary – bloodhold.nypressure.mainheart.ratemy.mo.depulse.app.tracker.diary
  • Chat Text SMS – com.echatsms.messageos
  • Hi Text SMS – ismos.mmsyes.message.texthitext.bobpsms
  • Emoji Theme Keyboard – com.gobacktheme.lovelyemojikeyboard
  • iMessager – start.me.messager
  • Text SMS – com.ptx.textsms
  • Camera Translator – com.haixgoback.outsidetext.languagecameratransla
  • Come Messages – com.itextsms.messagecoming
  • Painting Photo Editor – com.painting.pointeditor.photo
  • Rich Theme Message – com.getmanytimes.richsmsthememessenge
  • Quick Talk Message – mesages.qtsms.messenger
  • Advanced SMS – com.fromamsms.atadvancedmmsopp
  • Professional Messenger – com.akl.smspro.messenger
  • Classic Game Messenger – com.classcolor.formessenger.sic
  • Style Message – com.istyle.messagesty
  • Private Game Messages – com.message.game.india
  • Timestamp Camera – allready.taken.photobeauty.camera.timestamp
  • Social Message – com.colorsocial.message
  • Professional Messages – com.adore.attached.message

There is a wide range of malware programs that are developed by the Joker malware authors ranging from extremely complex to the most basic of applications.

The remote nature of these malicious apps is, to a large extent, one of the reasons why they are often unnoticed by antivirus softwares and the Play Store when they are evaluated.

It has also been discovered that Facebook users have been targeted by a type of malware known as Facestealer, found on the Google Play Store.

When a user successfully logs in, the malware author steals both the username and password along with the authentication tokens.

  • Vanilla Camera (cam.vanilla.snapp)
  • Unicc QR Scanner (com.qrdscannerratedx)


Besides the usual rules of thumb when it comes to downloading apps from app stores. Apart from this, users are recommended to follow these mitigations:-

  • Avoid granting unnecessary permissions
  • Verify app legitimacy
  • Always checking for developer information
  • Make sure to read all the reviews
  • Properly check all their privacy policies

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


BALAJI is a Former Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

New WiFi Flaw Let Attackers Hijack Network Traffic

A fundamental security issue in the design of the IEEE 802.11 WiFi protocol standard, according…

15 hours ago

A Military-Type Explosive Sent Via USB Drive to Detonate When Plug-in To Computer

The Ecuadorian free-to-air television network Ecuavisa recently reported that a USB device was detonated inside…

22 hours ago

UK Police Setup Thousands of  Fake DDoS-For-Hire Websites

The National Crime Agency (NCA) of the United Kingdom revealed that it had built several fake…

1 day ago

Parts of Twitter’s Source Code Leaked Online On GitHub

Recently, Twitter has acknowledged that some of its confidential source code has been exposed on…

2 days ago

Hackers Earned $1,035,000 for Exploiting 27 Zero-Days at Pwn2Own Vancouver

After the finale of Pwn2Own Vancouver 2023, the Masters of Pwn, Synacktiv (@Synacktiv), received $1,035,000…

2 days ago

Hackers Exploited Critical Microsoft Outlook Vulnerability To Gain Exchange Server Access

In response to a recent vulnerability identified in Outlook, Microsoft recently published a proper guide…

3 days ago