These Android Apps with a Million Play Store Installations Redirect Users to Malicious Sites

A set of four Android applications introduced by the exact same developer has been found directing victims to malicious internet websites as component of an adware and facts-stealing campaign.

The applications, revealed by a developer named Mobile applications Team and presently accessible on the Enjoy Retailer, have been collectively downloaded over a person million times.

In accordance to Malwarebytes, the web-sites are built to deliver revenues as a result of spend-per-simply click adverts, and even worse, prompt customers to install cleaner applications on their telephones with the target of deploying extra malware.

The list of applications is as follows –

• Bluetooth Application Sender (com.bluetooth.share.application) – 50,000+ downloads
• Bluetooth Vehicle Link (com.bluetooth.autoconnect.anybtdevices) – 1,000,000+ downloads
• Driver: Bluetooth, Wi-Fi, USB (com.driver.finder.bluetooth.wifi.usb) – 10,000+ downloads
• Cellular transfer: wise swap (com.cellular.quicker.transfer.clever.change) – 1,000+ downloads

It really is no surprise that malicious applications have devised new strategies to get past Google Participate in Keep security protections. Just one of the extra preferred techniques adopted by danger actors is to introduce time-primarily based delays to conceal their malicious actions.

Malwarebytes’ analysis found the applications to have an close to 4-day waiting around interval in advance of opening the to start with phishing web-site in Chrome browser, and then move forward to launch additional tabs each and every two hrs.

The apps are aspect of a broader malware operation termed HiddenAds, which has been energetic because at the very least June 2019 and has a track history of illicitly earning revenues by redirecting consumers to advertisements.

The conclusions also appear as researchers from Guardio Labs disclosed information of a malvertising marketing campaign dubbed Dormant Hues that leverages rogue Google Chrome and Microsoft Edge extensions to hijack person lookup queries to an actor-controlled area.

Identified this short article attention-grabbing? Stick to THN on Facebook, Twitter  and LinkedIn to examine a lot more exclusive information we write-up.

Some parts of this article are sourced from:
thehackernews.com