Those installing the iKHfaa VPN app are asked to enable location service
While most VPNs do not ask for permission to use location and contacts, iKHfaa VPN does. This made Cyfirma suspicious enough to dig deeper to find that “DoNot” was the attacker behind the malware. When installing the VPN app, it would also show a pop-up asking users to “turn on device location, which uses Google’s location service. If the GPS on the targeted person’s phone is on and active, the malicious app will be able to figure out the current location of the target. If not, the previous location will appear.
The first two apps listed by the developer in the Play Store are malicious
The two aforementioned apps, and a third one from the same developer (which does not appear to be malicious), remain in the Google Play Store. If you have either one installed on your phone no matter where you live, make sure to uninstall them as soon as possible. The name of the developer is SecurITY Industry and the number of downloads for the malicious apps is low which means that they are aimed at specific targets even though they appear in Google’s app storefront.
If this app is available from the Google Play Store in your region, do not install it on your phone
Remember, one of the best ways to prevent yourself from installing a malicious app on your phone to read the comments section. Look for red flags such as complaints from those who installed the app about their phones running too hot, running too slow, and suffering from rapid battery depletion. These are some of the signs that should make you run away from an app instead of installing it.
