Android antivirus apps caught spreading their own malware

(Image credit: Google)

Google has removed a number of fake Android antivirus apps from the Play Store after it was discovered they were being used as a vehicle for malware distribution.

According to cybersecurity experts from Check Point Research, the company responsible for the discovery, at least half a dozen antivirus apps available on the official Android marketplace were being used to spread banking malware. 

The apps in question are called:

  • Atom Clean-Booster, Antivirus
  • Antivirus, Super Cleaner
  • Alpha Antivirus, Cleaner
  • Powerful Cleaner, Antivirus
  • Center Security - Antivirus (two versions)

These malicious apps were carrying Sharkbot, a malware strain that steals passwords and banking information. It shares push notifications and offers up fake login prompts, through which users share their credentials with the attackers. 

Although all have since been removed from the Play Store, Check Point says they still remain active in unofficial markets. Android users who had downloaded the apps before they were removed are advised to uninstall them immediately.

TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a £100 Amazon gift card (or equivalent in USD). Thank you for taking part.

>> Click here to start the survey in a new window <<

Sparing Russians and the Chinese

In a single week of analysis, more than 1,000 unique infected endpoints were identified, with the number growing by roughly 100 every day. Google Play Store figures show the malicious apps were downloaded roughly 11,000 times in total.

The threat actor’s identity remains unknown, although the researchers say they have reason to believe they are of Russian origin. The malware comes with geo-fencing features, ignoring devices in China, India, Romania, Russia, Ukraine, and Belarus. Most of the victims are located in the UK and Italy. 

The developer accounts that uploaded the apps were Zbynek Adamcik, Adelmio Pagnotto and Bingo Like Inc. Of the three accounts, two have been active since the autumn of 2021. 

Simply downloading the app won’t be enough for the threat actors to launch a full-blown attack, however. The victim still needs to grant the app permissions for accessibility services, which is something the app will try and trick the victim into doing.

After the app is granted the permissions, it will take over most of the smartphone’s functions and will be able to operate freely.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.