Wednesday, April 23, 2025
HomeAndroidNew Malware Family "Venus" In Google Play Store Infects 285,000 Android Users...

New Malware Family “Venus” In Google Play Store Infects 285,000 Android Users to Subscribe Premium Ads

Published on

SIEM as a Service

Follow Us on Google News

Researchers discovered a new Trojan family called “Venus” resides in the Google play store infected at least 285,000 Android users around the world.

There are 8 apps involved with the malicious activities in Android user’s device and it is mainly targeting the carrier billing and advertising area.

Venus
8 Malicious apps list

Threat actors developed these apps to interact with Ads and subscribe the user to premium services without any sort of notification, and it also bypasses the Google Play protect and malware detection system.

- Advertisement - Google News

There are several countries were targeted by this malware campaign including Belgium, France, Germany, Guinea, Morocco, Netherlands, Poland, Portugal, Senegal, Spain, and Tunisia.

Malware Infection Process via Malicious App

Researchers observed that most of the data consumed by an application called “Quick scanner” which is protected by a library that encrypts and hides files. 

Venus

According to Evina research, “The application uses the libjiagu library created by the Chinese company Qihoo. The library protects the application’s content and runs protections against reverse engineering. Unfortunately, fraudsters take advantage of the library to use it dishonestly.”

Further deep analysis revealed that the apps have fraudulent code in compiled Android file and it processes the anti-reverse check after the file was imported and decrypted in memory in order to bypass Google’s detection.

“Venus is waiting for the right time to attack. The malware is able to register time after the application has been downloaded instead of being launched on the very first day.” Evina said.

Once it performed the successful attack, Venus malware communicates with the C2 server domain(glarecube[.]com) which is controlled by an attacker to send the encrypted request.

After decrypted, Server response with two following things.

  1) All the instructions containing URLs that redirect to premium services or websites containing ads, all created by the fraudster
     2) The javascript commands making the fraudulent process

With running an application, the URL simply loaded into the browser without letting users know whats going on and it subscribes to the premium ads, at the end attackers can make its profit from advertisements clicks and premium services subscriptions.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Cloudflare Tunnel Infrastructure to Deploy Multiple Remote Access Trojans

The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network...

Threat Actors Leverage npm and PyPI with Impersonated Dev Tools for Credential Theft

The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted...

Hackers Exploit Legitimate Microsoft Utility to Deliver Malicious DLL Payload

Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into...

Cybercriminals Exploit Network Edge Devices to Infiltrate SMBs

Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation

Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

Hackers Claim to Sell ‘Baldwin Killer’ Malware That Evades AV and EDR

A notorious threat actor has allegedly begun selling “Baldwin Killer,” a sophisticated malware toolkit...