Antivirus apps downloaded thousands of times from Google Play Store contain password-stealing malware

palm face: It’s starting to feel like Google is losing its breath to warn people about the dangers of sideloading apps, given the number of malware infested infiltrating the Play Store. Six more were discovered and deleted after login credentials were stolen while impersonating antivirus apps.

Checkpoint Security Researchers Referred The six apps were downloaded more than 15,000 times before Google pulled them from its Play Store following the cybersecurity firm’s disclosure. While users thought they were downloading mobile antivirus apps, they were actually installing shark Android thief, ironically.

Sharkbot works by persuading victims to enter their credentials into windows that simulate input forms, often when it detects that banking apps are open. It can also steal information by logging keystrokes, intercept SMS messages, and gain full remote access.

More pro-virus than anti-virus

Once a person enters their username and password, the details are sent to a malicious server and used to access accounts like banks, social networks, emails, etc.

Most of the victims came from the United Kingdom and Italy. Interestingly, the malware used geofences to identify and ignore users in China, India, Romania, Russia, Ukraine or Belarus.

The apps were able to bypass Play Store protection because their malicious behavior was only activated after someone downloaded one and connected to the server, he writes ZDNet.

The infested Sharkbot apps were removed from the Google Play Store in March, although they are still available on other storefronts.

Just two weeks ago, researchers from French mobile security company Pradeo revealed that an app called Craftsart Cartoon Photo Tools contained a copy of the Android Trojan called Facestealer. It was able to steal the Facebook login credentials of mobile users and was downloaded more than 100,000 times before Google removed it.