Android Trojan Kills Google Play Protect, Spews Fake App Reviews

mood · Jan 11, 2020

Android Trojan Kills Google Play Protect, Spews Fake App Reviews
Trojan-Dropper.AndroidOS.Shopper.a
January 11, 2020
https://www.bleepingcomputer.com/ne...s-google-play-protect-spews-fake-app-reviews/

An Android malware strain camouflaged as a system app is used by threat actors to disable the Google Play Protect service, generate fake reviews, install malicious apps, show ads, and more.

The heavily obfuscated malware dubbed Trojan-Dropper.AndroidOS.Shopper.a uses a system icon and the ConfigAPKs name which closely resembles the name of a legitimate Android service responsible for app configuration the first time a device is booted.

"Trojan-Dropper.AndroidOS.Shopper.a was most widespread in Russia, where the largest share of infected users (28.46%) was recorded in October – November 2019," Kaspersky Lab researcher Igor Golovin said. "Second place went to Brazil (18.70%) and third to India (14.23%)."
Malicious Play Store promotion services
Once it infects a victim's Android device, the malware downloads and decrypts the payload, then goes straight to information harvesting, collecting device info such as country, network type, vendor, smartphone model, email address, IMEI, and IMSI.

All this is done by abusing the Accessibility Service, a known tactic used by Android malware to perform a wide range of malicious activities without needing user interaction [1, 2, 3, 4].
Click to expand...

Kaspersky: Smartphone shopaholic

Have you ever noticed strange reviews of Google Play apps that look totally out of place? Their creators might give it five stars, while dozens of users rate it with just one, and in some cases the reviews seem to be talking about some other program entirely.
Conclusion
As noted above, one of the things that drew our attention was the use of AccessibilityService. This service is usually accessed by people with vision problems to facilitate smartphone use, such as having the names of app controls, web page content, etc., read out automatically.

And the best option is not to install apps from dubious sources at all, including from ads, whatever they promise.
In any event, it’s worth getting hold of a mobile security solution that can independently detect and block dangerous apps.
Click to expand...

Log in or Sign up

Android Trojan Kills Google Play Protect, Spews Fake App Reviews

mood Updates Team

Log in or Sign up

Android Trojan Kills Google Play Protect, Spews Fake App Reviews

mood Updates Team

Useful Searches