Get rid of these apps with 300k+ installs Google just kicked off Play Store for being dangerous

Joker Android apps removed from Google Play Store

Joker was first discovered in 2019 and we have seen many variants of this spyware that stealthily subscribes people to premium services and steal text messages, contact lists, and device information, among other things. It keeps finding its way to the Play Store by regularly modifying its trace signatures. Over the past two months, the following Joker apps were found on Google’s official app store. 

The mode of attack is that many apps are released together and hide within them a malicious payload. The Joker malware often hides in messaging apps that require you to grant escalated access permissions. It then uses those permission to achieve its motives. For instance, in the Enjoy SMS app, the payload is hidden in an obfuscated path. 

Facestealer malware

Facestealer malware is used to steal Facebook credentials with fake login screens. One of the apps that ThreatLabz came across was cam.vanilla.snapp and it has been downloaded more than 5,000 times.

Coper trojan

This banking trojan uses a multi-stage infection chain to compromise Android smartphones and run harmful activities. It targets banking apps in Europe, Australia, and South America. They are disguised as legitimate apps and once a user downloads them from Google’s Play Store, they unleash the malware infection capable of intercepting and sending SMS messages, keylogging, locking and unlocking screens, preventing uninstalls and allowing bad actors to take control of infected phones. This ultimately leads to the perpetrators gaining access to the information they need to rob victims of their money.

For instance, an app called Unicc QR Scanner prompts users to update the app as soon as it is installed. After that, a backdoor or malware is installed in the device to help the attacker gain full control of the phone.

Unicc QR Scanner with Coper malware on the Play Store