4 Million Android Users Infected by Malicious Beauty Camera App From Google Play that Steals Personal Pictures

Google play Store flooding the several malicious beauty camera apps that steal Android users sensitive images and apps, the malicious app was already downloaded by more than 4 million Android users.

Initially, these apps don’t indicate any malicious activities until infected users decide to delete the app and the maximum number of downloads originated from Asia.

These apps are difficult to uninstall since the hide its icon from the application list that make difficult to drag the app and uninstall from home page.

For instances, one of the malicious app from Google play store called com.beauty.camera.project.cloud popups the pornography contents ads whenever infected users unlock the screen.

Researchers found a paid online pornography player (detected as AndroidOS_PornPlayer.UHRXA) that was downloaded when clicking the pop-up.

29 apps were claiming to be camera or photo-editing related, with the top three, “Pro Camera Beauty,” “Cartoon Art Photo,” and “Emoji Camera,” getting over 1 million downloads each, while others like “Artistic effect Filter,” “Selfie Camera Pro,” and “Horizon Beauty Camera,” had over 100,000 downloads each.

Malicious Android Apps infection Process

Malicious ads are doesn’t indicate anything and its very difficult for users to determine that where it come from and who is behind these ads.

Some of the malicious Android apps are redirecting users to Phishing websites where the users tricks and give away their personal information, such as addresses and phone numbers.

For instance, one of the apps that you can see in the above image indicates to force users to click OK that leads to one of the malicious websites which claim that the user wins the cash price and asking the personal details.

According to Trend micro “Further investigation led to another batch of photo filter-related apps that share similar behavior on Google Play. These apps seemingly allow users to “beautify” their pictures by uploading them to the designated server. “

Finally, instead of edited photo result, Users getting the picture with a fake update prompt in nine different languages and the attackers collect the uploaded photo for malicious purpose.

All the malicious apps ware reported to Google and it was taken down from Google play but still already downloaded users are affected by these malicious apps.

Given that many of these malicious apps take great pains to look as legitimate as possible, users should always investigate the legitimacy of an app. One good method of doing this is by checking reviews from other users, Trend Micro said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

2 Android Apps From Google Play Store Launching Banking Malware With Sophisticated Evasion Techniques

9 Fake Apps Found On Google Play With More than 8 Million Installs

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

New PLAYFULGHOST Malware Hacking Devices To Remotely Capture Audio Recordings

PLAYFULGHOST, a Gh0st RAT variant, leverages distinct traffic patterns and encryption, which spread via phishing…

2 minutes ago

Researchers Uncover Phishing-As-A-Service Domains Associated With Tycoon 2FA

The Tycoon 2FA platform is a Phishing-as-a-Service (PhaaS) tool that enables cybercriminals to easily launch…

3 minutes ago

Windows 11 BitLocker Encryption Bypassed to Extract Full Volume Encryption Keys

A cybersecurity researcher has demonstrated a method to bypass BitLocker encryption on Windows 11 (version…

8 minutes ago

SmuggleShield – Browser Extension to Detect HTML Smuggling Attacks

SmuggleShield, a recently launched browser extension, is gaining attention in the cybersecurity space for its…

2 hours ago

EC2 Grouper Hackers Using AWS Tools To Exploit Compromised Credentials

Cloud security researchers have uncovered alarming trends in identity compromises within Amazon Web Services (AWS)…

4 hours ago

Trend Micro Apex One Vulnerabilities Let Escalate Privilege

Trend Micro has addressed six high-severity vulnerabilities in its Apex One and Apex One as a Service product, which…

5 hours ago