PhishLabs Warns of Malware Posing as Legit Apps on Google Play
Eleven malicious applications posing as popular mobile payment apps were found by security firm PhishLabs on the official Google Play application store.
Those at risk of being tricked by these malware apps are Android users who buy or download applications through unofficial 3rd party application stores. This, however, does not mean that users downloading from the official Google Play store aren’t prone to these fake
In a statement released publicly, PhishLabs said they found at least 11 malware apps posing as legitimate ones since the beginning of the year. These apps pretend to give unknowing Android users access to online payment methods, but only really collect the user’s personal data and logins – then sending the information collected to a database that belongs to the cybercriminals. Joshua Shilko, PhishLabs’ security analyst, first reported about the criminals’ modus.
Google now performs more rigorous manual and automated tests for apps submitted to their store.
The names of the 11 spoofed apps weren’t revealed, but 10 of them have links on their websites that lead to their mobile apps. Shilko also added that one of the companies spoofed stated they had no app on their website. Also, all 11 seem to have been made by the same malware creator or team of creators.
After downloading the fake app, users are lead to a website that has the same look and feel of the legitimate company’s website. When a victim inputs his or her credentials, this information is instantly sent to the hackers.
The next step would be a window asking for additional information or answers to security questions for the account. Once all this is done, the user is shown a window saying an error occurred or that the login credentials were incorrect.
Google previously did not have control over checking the applications on their app stores; however, they now perform more rigorous manual and automated tests on applications submitted to the play store.
Shilko concludes that the appearance of these malware apps on the play store posits that more work is needed in terms of security among apps. These discovered fake apps went through the reviews Google performed, raising questions about the company’s review process. According to Shilko, “all of the applications reference in the post had been removed except for one.”
Comprehensive multi-device protection for you and your family for up to 6 PCs, Macs, Android, and iOS devices. For more info click here.
