Saturday, December 2, 2023

New Variant of Infamous Android Joker Malware Bypasses Google Play Security to Attack Users

The Joker malware detected in early June 2019, it employs several tactics to bypass GooglePlay protection and to perform several malicious activities.

The malware used to hide inside different apps and once users downloaded to the phone they got infected with the Joker malware.

It aims to steal money from the user by signing for paid subscriptions, it interacts with the user’s SMS messages, contact lists, and other data from the device.

Earlier it was observed that Joker malware hidden with 24 apps different apps, all the apps have been reported to Google and removed from the store.

New Joker variant

Check Point researchers discovered a new variant of Joker Dropper and Premium Dialer spyware in Google Play hidden with 11 apps that removed from Google Play on April 30, 2020.

The updated version of Joker malware hides behind look like legitimate apps and downloads additional malware on the device.

“This time, however, the malicious actor behind Joker adopted an old technique from the conventional PC threat landscape and used it in the mobile app world to avoid detection by Google.”

The Joker malware utilizes Notification Listener service and a dynamic dex file loaded from the C&C server to subscribe to users for the premium services.

The new malware also checks the malicious flow every time by creating a new object that communicates with the C&C to check if the campaign was still active.

To minimize the Joker’s fingerprint, the malicious actors loaded the dynamic dex file “from sight while still ensuring it can load – a technique which is well-known to developers of malware for Windows PCs.”

The new variant of the malware hides it’s malicious dex file within the application as Base64 encoded strings, ready to be decoded and loaded.

The new variant also contains the code of the original Joker malware in its main dex file “the registration of the NotificationListener service, subscribing the user to premium services, and more.”

Here you can find the package names of 11 malicious applications that hide a new variant of Joker.

If you have installed any of the malicious apps, it is recommended to remove them immediately and to check your mobile and credit-card bills for unwanted charges.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Cerberus Android Banking Malware Mimic as Currency Converter App Found on Google Play

Android Devices Infected with Undeletable Adware that Sits on System Partition


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles