Malware-infected apps sneak into Google Play, leave Android devices wide open for attacks
The apps 'Viking Jump', 'WiFi Plus', 'Parrot Copter', 'Memory Booster', and 'Simple 2048' contain malicious components that begin their activity post their initial launch. Two binaries named like Android system files are installed on the storage, with one used for exchanging information between the malware's parts, and the other keeping a list of all its components. The virus checks for root permissions, and if your device is rooted, two additional components are installed for the attackers' purposes. Regardless of whether you have root access or not, the malware will connect to its command and control server, sending the device's battery charge, type of data connection, and phone number.
Download top-ranked app, get infected. No extra in-app purchases required!Finally, the server opens a proxy connection capable of sending and receiving information between server and device according to the hacker's whim. In this campaign's case, devices are hijacked to simulate clicks on online advertisements and generate profit. Some of the applications also send premium SMS messages, and the proxy allows for DDoS attacks, spamming, and remote code execution. Your device pretty much becomes the hacker's puppet.
Checkpoint Security traced 44% of the infections to Russia, which is explained by the prevalence of Android 4.4 in the country. Later operating system versions (Lollipop and Marshmallow) have stricter permissions control, thus the malware which relies on very suspicious permission sets is less likely to get past observant users. Alas, the researchers haven't made recommendation about anything you could do in the event of infection. Hopefully, a decent antivirus app will be able to bring things back in order.