Dropper apps are spreading malware that can steal money from Android users’ banking apps
The apps that help carry the malware get past Google’s Play Store security are called dropper apps. They are aptly named since these apps have a payload consisting of malicious apps which are installed on an infected handset. In its report Trend Micro writes, “Malicious actors have been surreptitiously adding a growing number of banking trojans to Google Play Store via malicious droppers this year, proving that such a technique is effective in evading detection.”
Kicked out of the Play Store, make sure none of these apps remain on your phone
Additionally, because there is a high demand for novel ways to distribute mobile malware, several malicious actors claim that their droppers could help other cybercriminals disseminate their malware on Google Play Store.” Late last year, Trend Micro discovered a new variant of dropper which it named DawDropper. These apps were originally found in the Google Play Store under the titles:
- Call Recorder APK (com.caduta.aisevsk)
- Rooster VPN (com.vpntool.androidweb)
- Super Cleaner- hyper & smart (com.j2ca.callrecorder)
- Document Scanner – PDF Creator (com.codeword.docscann)
- Universal Saver Pro (com.virtualapps.universalsaver)
- Eagle photo editor (com.techmediapro.photoediting)
- Call recorder pro+ (com.chestudio.callrecorder)
- Extra Cleaner (com.casualplay.leadbro)
- Crypto Utils (com.utilsmycrypto.mainer)
- FixCleaner (com.cleaner.fixgate)
- Just In: Video Motion (com.olivia.openpuremind)
- com.myunique.sequencestore
- com.flowmysequto.yamer
- com.qaz.universalsaver
- Lucky Cleaner (com.luckyg.cleaner)
- Simpli Cleaner (com.scando.qukscanner)
- Unicc QR Scanner (com.qrdscannerratedx)
While Google booted these apps out of the Play Store, they could still be on your Android phone. If they are, uninstall them immediately.
Trend Micro adds that “DawDropper’s malicious payload belongs to the Octo malware family, which is a modular and multistage malware that is capable of stealing banking information, intercepting text messages, and hijacking infected devices. Octo is also known as Coper, and it has been historically used to target Colombian online banking users.”
Google is also making policy changes to the Google Play Store including the banning of copycat apps
Ironically, one app that could be impacted is pro-privacy firm DuckDuckGo’s “App Tracking Protection” app which creates VPNs to block trackers found in other apps.
