Thursday, October 10, 2024
HomeSecurity NewsFake Android Apps that Impersonate as Security Applications Found in Play store...

Fake Android Apps that Impersonate as Security Applications Found in Play store with 6000,000 Installations

Published on

Newly discovered Fake Android Apps in Google play store that posed as offering security proving unwanted ads and other potential cyber threats to installed user device and collection a lot of sensitive information.

In this case, 35 Malicious Fake Android Apps discovered in official Google Play Store that posed as security apps but it doesn’t contain any of security future.

A lot of these fake security apps are impersonating as security application and show malicious ads to generating revenue.

- Advertisement - EHA

All the discovered Fake Android Apps installed over 6 Million times in the user devices and these apps are being under the radar for last few years.

Also not all the apps were downloaded manually but some of these applications are downloaded and installed by bots to post positive reviews and improve their respective app’s ratings.

Fake Android Apps
35 Apps that offer Fake security prevention

It Mimics as very primitive security checkers relying on a few trivial hardcoded rules and eventually it flag legitimate security apps as malicious.

Also, it creates false alerts to victims as your mobile under potential risk state by malware which actually doesn’t perform any malicious activities.

According to ESET Researchers, among these 35 apps, only a handful stand out for their specific features: one app is not completely free as it offers a paid upgrade; one app has implemented a primitive, easily bypassed, app-locker manager; another app flags other apps from this group as dangerous by default.

Fake Android Apps

How the Fake Android Apps Mimic as Real Security Apps

All the flagged fake security apps are posed as actual mobile security solutions and it staying under the radar to avoid detection and their app detection mechanisms easy to bypass.

These fake security  apps are 4 categories that contain  Security-mimicking functionality

Package name whitelist & blacklist 

Its Whitelisting Popular apps such as Facebook, Instagram, LinkedIn, Skype and others. its blacklist few apps.

Permissions blacklist

All apps (including legitimate ones) are flagged if they require some of the listed permissions that are considered dangerous, such as send and receive SMS, access location data, access the camera, etc.

 Source whitelist

All apps but those from the official Android store, Google Play, are flagged – even if they are completely benign.

 Activities blacklist

All apps that contain any of the blacklisted activities: that is, parts of applications. This mainly concerns some ad-displaying activities.

You can Refer the ESET for IOC’s and Fake AntiVirus Apps Name.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploiting Zero-day Flaw in Qualcomm Chips to Attack Android Users

Hackers exploit a zero-day vulnerability found in Qualcomm chipsets, potentially affecting millions worldwide.The flaw,...

Foxit PDF Reader Vulnerability Let Attackers Execute Arbitary Code

Researchers recently disclosed six new security vulnerabilities across various software, as one critical vulnerability...

Wireshark 4.4.1 Released, What’s new!

Wireshark, the world’s leading network protocol analyzer, has just released version 4.4.1, bringing a...

Multiple VMware NSX Vulnerabilities Let Attackers Gain Root Access

VMware has disclosed multiple vulnerabilities in its NSX product line that could potentially allow...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Critical PDF.js & React-PDF Vulnerabilities Threaten Millions Of PDF Users

A new critical vulnerability has been discovered in PDF.js, which could allow a threat...

LayerX Security Raises $26M for its Browser Security Platform, Enabling Employees to Work Securely From Any Browser, Anywhere

LayerX, pioneer of the LayerX Browser Security platform, today announced $24 million in Series...

Email Header Analysis – Verify Received Email is Genuine or Spoofed

Email Header Analysis highly required process to prevent malicious threats since Email is...