The notorious Joker malware (opens in new tab) has once again found its way into the official Google Play Store by making subtle tweaks to get past automated checks, reports have claimed.
The Joker family of malware has been infecting apps on Google's Play Store (opens in new tab) for the last few years, and has even cropped up on other prominent app stores (opens in new tab) such as Huawei (opens in new tab)’s.
“Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques,” suggests researchers from cloud security (opens in new tab) firm Zscaler.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
>> Click here to start the survey in a new window (opens in new tab) <<
- We’ve compiled a list of the best Android antivirus apps (opens in new tab)
- These are the best endpoint protection tools (opens in new tab)
- Check our list of the best firewall apps and services (opens in new tab)
Zscaler suggests that the Joker spyware (opens in new tab) is designed to steal SMS messages, contact lists, and device information and will also silently sign up victims to premium wireless application protocol (WAP) services.
Zscaler's team has had its eye on Joker for some time now, and were recently alerted by a spate of uploads on the Play Store. After verifying the presence of the malware, the researchers alerted the Google Android Security team, which promptly removed over a dozen suspicious apps flagged by the researchers.
In their analysis of this latest Joker strain, Zscaler notes that the malware employs three different tactics to bypass Google Play’s vetting process.
One involves directly embedding the URL of the command and control (C2) server in the code itself masquerading it with the help of string obfuscation. Other techniques involve downloading one or two stager payloads, whose URLs are AES encrypted to make them illegible.
The final payload of all three tricks is the malicious code that employs DES encryption to execute its malicious spyware activities.
Given the ease with which the malware managed to sneak past Google’s filters, the researchers suggest users to be alert and always pay close attention to the permission sought by apps they want to install, keeping their eyes peeled for “risky permissions” related to messages, call logs, contacts, and other sensitive areas on the device.
- Protect your devices with these best antivirus software (opens in new tab)