Thursday, November 14, 2024
HomeAndroidNew Variant of Infamous Android Joker Malware Bypasses Google Play Security to...

New Variant of Infamous Android Joker Malware Bypasses Google Play Security to Attack Users

Published on

The Joker malware detected in early June 2019, it employs several tactics to bypass GooglePlay protection and to perform several malicious activities.

The malware used to hide inside different apps and once users downloaded to the phone they got infected with the Joker malware.

It aims to steal money from the user by signing for paid subscriptions, it interacts with the user’s SMS messages, contact lists, and other data from the device.

- Advertisement - SIEM as a Service

Earlier it was observed that Joker malware hidden with 24 apps different apps, all the apps have been reported to Google and removed from the store.

New Joker variant

Check Point researchers discovered a new variant of Joker Dropper and Premium Dialer spyware in Google Play hidden with 11 apps that removed from Google Play on April 30, 2020.

The updated version of Joker malware hides behind look like legitimate apps and downloads additional malware on the device.

“This time, however, the malicious actor behind Joker adopted an old technique from the conventional PC threat landscape and used it in the mobile app world to avoid detection by Google.”

The Joker malware utilizes Notification Listener service and a dynamic dex file loaded from the C&C server to subscribe to users for the premium services.

The new malware also checks the malicious flow every time by creating a new object that communicates with the C&C to check if the campaign was still active.

To minimize the Joker’s fingerprint, the malicious actors loaded the dynamic dex file “from sight while still ensuring it can load – a technique which is well-known to developers of malware for Windows PCs.”

The new variant of the malware hides it’s malicious dex file within the application as Base64 encoded strings, ready to be decoded and loaded.

The new variant also contains the code of the original Joker malware in its main dex file “the registration of the NotificationListener service, subscribing the user to premium services, and more.”

Here you can find the package names of 11 malicious applications that hide a new variant of Joker.

If you have installed any of the malicious apps, it is recommended to remove them immediately and to check your mobile and credit-card bills for unwanted charges.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Cerberus Android Banking Malware Mimic as Currency Converter App Found on Google Play

Android Devices Infected with Undeletable Adware that Sits on System Partition

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto

Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and...

Google to Issue CVEs for Critical Cloud Vulnerabilities

Google Cloud has announced a significant step forward in its commitment to transparency and...

GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster

GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware

A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community...

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...