• Skip to main content
  • Skip to secondary menu
  • Skip to primary sidebar
  • Home
  • Contact Us

iHash

News and How to's

  • Prism Drive Secure Cloud Storage: Lifetime Subscription (10TB) for $89

    Prism Drive Secure Cloud Storage: Lifetime Subscription (10TB) for $89
  • Mashvisor: Lifetime Subscription (Professional Plan) for $199

    Mashvisor: Lifetime Subscription (Professional Plan) for $199
  • Beducated: Lifetime Subscription for $99

    Beducated: Lifetime Subscription for $99
  • Amysen Wi-Fi Smart Plug (4-Pack) for $23

    Amysen Wi-Fi Smart Plug (4-Pack) for $23
  • Refurbished Apple iPad 4 (2012) WiFi Black / 16GB / Grade A for $76

    Refurbished Apple iPad 4 (2012) WiFi Black / 16GB / Grade A for $76
  • News
    • Rumor
    • Design
    • Concept
    • WWDC
    • Security
    • BigData
  • Apps
    • Free Apps
    • OS X
    • iOS
    • iTunes
      • Music
      • Movie
      • Books
  • How to
    • OS X
      • OS X Mavericks
      • OS X Yosemite
      • Where Download OS X 10.9 Mavericks
    • iOS
      • iOS 7
      • iOS 8
      • iPhone Firmware
      • iPad Firmware
      • iPod touch
      • AppleTV Firmware
      • Where Download iOS 7 Beta
      • Jailbreak News
      • iOS 8 Beta/GM Download Links (mega links) and How to Upgrade
      • iPhone Recovery Mode
      • iPhone DFU Mode
      • How to Upgrade iOS 6 to iOS 7
      • How To Downgrade From iOS 7 Beta to iOS 6
    • Other
      • Disable Apple Remote Control
      • Pair Apple Remote Control
      • Unpair Apple Remote Control
  • Special Offers
  • Contact us

Malware disguised as Minecraft mods on Google Play, continued

Jun 10, 2021 by iHash Leave a Comment


Although we recently reported finding 20 apps in Google Play posing as Minecraft modpacks — the most popular with more than a million downloads — Minecraft-themed malware continues to pop up in Google Play. Instead of doing anything they claimed, the apps turned users’ smartphones and tablets into extremely intrusive advertising tools.

To be clear, the apps were totally useless from a user perspective. Instead, after the first run they hid their icons and repeatedly opened the browser to flash ads. They could also play videos from YouTube, open Google Play app pages, and more. The version we analyzed, for example, opened the browser every two minutes, rendering the device essentially unusable. The thing was especially troubling, because it was extremely hard for a user to figure out what was going on, which app was responsible for the troubles and how to stop it.

We notified Google about our find, and the malicious apps were quickly removed from the store.

Table of Contents

  • New versions of malicious apps
    • New, improved versions
    • Simplified version with paid subscription on Google Play
    • Facebook-account-stealing version
    • Apps from alternative stores

New versions of malicious apps

Deletion from Google’s app store does not necessarily defeat malware; historically, its makers simply upload new, slightly modified, versions using different names and from different developer accounts.

One example of the cycle comes from the VK Music Trojan, which stole VK user accounts and, despite being reported, dug in to Google Play for several years.

Mindful of that, we revisited the case of the harmful Minecraft modpacks in Google Play to find out whether reporting had helped. To that end, we launched a search for similar apps — and found some.

New, improved versions

First, we found several apps using the abovementioned approach, but with some improvements. In a basic scenario the apps accept push message commands from the attackers to show full-screen ads (no user interaction required). The apps are designed to download an extra module as well. With that module downloaded, more functions become available, enabling the apps to hide their icons, run the browser, play YouTube videos, open Google Play app pages, and so forth.

This time, the list of compromised apps included, in addition to Minecraft mods, a file recovery utility called File Recovery – Recover Deleted Files. Version 1.1.0, available from Google Play until February 2021 had a malicious payload. That version has been removed, and version 1.1.1, which is now on Google Play, is safe.

Simplified version with paid subscription on Google Play

Second, we found a couple of Minecraft modpacks with basic functionality, a configuration in which the apps occasionally show full screen ads, even with the app inactive, but are unable to hide their icons or run the browser, YouTube, or Google Play. For extra monetization, the in-app purchases function is used.

One of the malicious Minecraft modpacks in Google Play

One of the malicious Minecraft modpacks in Google Play

Interestingly, one of the apps is now available from the store as a “basic” version and with in-app purchases enabled, whereas a couple of months back it relied on the extra downloadable module. From this we conclude that their owners are continuing to experiment with monetization options.

Facebook-account-stealing version

Third, we found several more apps were found in which the described above malicious functionality was not the core one. A while ago, for example, Google Play carried a fake Madgicx advertising network app and a fake TikTok ad-management app that would insistently prompt for the user’s Facebook account data and, if user provided it, would steal the account.

Apps from alternative stores

Finally, many such apps remain available from alternative stores even after Google removes them from its store. Which is no surprise; even Google, with vastly more resources than the average company, can’t always promptly moderate the great volume of existing apps. Yet we decided to mention this aspect here, as it provides clear evidence that alternative stores are unsafe to use. If still intending to use them for whatsoever reason, at least install a reliable mobile antivirus to protect you against dangerous apps.

That said, as we see from this story, as well as many other episodes of malware getting into the official Google app store, even if you download your apps only from Google Play, you are still better off with an antivirus on your smartphone.





Source link

Share this:

  • Facebook
  • Twitter
  • Pinterest
  • LinkedIn

Filed Under: Security Tagged With: continued, disguised, google, Malware, Minecraft, mods, play

Special Offers

  • Prism Drive Secure Cloud Storage: Lifetime Subscription (10TB) for $89

    Prism Drive Secure Cloud Storage: Lifetime Subscription (10TB) for $89
  • Mashvisor: Lifetime Subscription (Professional Plan) for $199

    Mashvisor: Lifetime Subscription (Professional Plan) for $199
  • Beducated: Lifetime Subscription for $99

    Beducated: Lifetime Subscription for $99
  • Amysen Wi-Fi Smart Plug (4-Pack) for $23

    Amysen Wi-Fi Smart Plug (4-Pack) for $23
  • Refurbished Apple iPad 4 (2012) WiFi Black / 16GB / Grade A for $76

    Refurbished Apple iPad 4 (2012) WiFi Black / 16GB / Grade A for $76

Reader Interactions

Leave a ReplyCancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Primary Sidebar

  • Facebook
  • GitHub
  • Instagram
  • Pinterest
  • Twitter
  • YouTube

More to See

Mashvisor: Lifetime Subscription (Professional Plan) for $199

Oct 3, 2023 By iHash

What Does the Commercialization of Generative AI Mean for Society?

Oct 2, 2023 By iHash

Tags

* Apple attacks Cisco computer security cyber attacks cyber crime cyber news cybersecurity Cyber Security cyber security news cyber security news today cyber security updates cyber threats cyber updates data data breach data breaches google hacker hacker news Hackers hacking hacking news how to hack incident response information security iOS 7 iOS 8 iPhone Malware microsoft network security ransomware ransomware malware risk management security security breaches security vulnerabilities software vulnerability the hacker news Threat update video web applications

Latest

Prism Drive Secure Cloud Storage: Lifetime Subscription (10TB) for $89

Expires January 01, 2030 05:00 PST Buy now and get 87% off KEY FEATURES Free up space on your phone, tablet, laptop, or home computer. Keep all your important files securely in one place. Easily share large files, like video, graphics, images, and audio. Access files from your computer, your phone, or your tablet. Preview […]

Beducated: Lifetime Subscription for $99

Expires January 01, 2024 07:59 PST Buy now and get 66% off KEY FEATURES Learn how to have great sex with Beducated, the #1 online platform for pleasure-based sex education. The extensive library boasts 100+ online courses on everything from basic oral sex guides to rope-bondage tutorials, all produced by the world’s top experts. As […]

Amysen Wi-Fi Smart Plug (4-Pack) for $23

Expires October 03, 2123 07:59 PST Buy now and get 52% off KEY FEATURES Introducing the Amysen smart plug – your ultimate home automation solution. Compatible with Alexa and Google Assistant, this smart plug allows for voice control and seamless integration with your smart home ecosystem. The schedule feature enables you to set specific times […]

Video Highlights: Vicuña, Gorilla, Chatbot Arena and Socially Beneficial LLMs — with Prof. Joey Gonzalez

Why Car Storage Depends on the Right Workload Analysis In this sponsored post, Russell Ruben, director of automotive and emerging segment market, Western Digital, believes that as vehicle innovation continues over the next few years, driven by advances in sensors, 5G, AI, machine and deep learning and big data analytics, so must storage. Storage technology […]

Swift 5.9 Released

Swift 5.9 is now available! 🎉 This is a major new release that adds an expressive macro system to the language and introduces support for integrating Swift into C++ codebases through bidirectional interoperability. It also introduces parameter packs, an improved expression evaluator while debugging, enhanced crash handling, Windows platform improvements, and more. Read on for […]

Anaconda’s State of Data Science Report Report Reveals Surge in AI Upskilling Among Data and IT Professionals

Anaconda Inc., provider of the popular platform for data science and modern AI development, released its sixth annual State of Data Science report, surfacing insights into today’s vibrant data science community and the growth and usage of AI and open-source software.  Unlike previous years, the 2023 report delves into the ways generative artificial intelligence (AI) is reshaping […]

Jailbreak

Pangu Releases Updated Jailbreak of iOS 9 Pangu9 v1.2.0

Pangu has updated its jailbreak utility for iOS 9.0 to 9.0.2 with a fix for the manage storage bug and the latest version of Cydia. Change log V1.2.0 (2015-10-27) 1. Bundle latest Cydia with new Patcyh which fixed failure to open url scheme in MobileSafari 2. Fixed the bug that “preferences -> Storage&iCloud Usage -> […]

Apple Blocks Pangu Jailbreak Exploits With Release of iOS 9.1

Apple has blocked exploits used by the Pangu Jailbreak with the release of iOS 9.1. Pangu was able to jailbreak iOS 9.0 to 9.0.2; however, in Apple’s document on the security content of iOS 9.1, PanguTeam is credited with discovering two vulnerabilities that have been patched.

Pangu Releases Updated Jailbreak of iOS 9 Pangu9 v1.1.0

  Pangu has released an update to its jailbreak utility for iOS 9 that improves its reliability and success rate.   Change log V1.1.0 (2015-10-21) 1. Improve the success rate and reliability of jailbreak program for 64bit devices 2. Optimize backup process and improve jailbreak speed, and fix an issue that leads to fail to […]

Activator 1.9.6 Released With Support for iOS 9, 3D Touch

  Ryan Petrich has released Activator 1.9.6, an update to the centralized gesture, button, and shortcut manager, that brings support for iOS 9 and 3D Touch.

Copyright iHash.eu © 2023
We use cookies on this website. By using this site, you agree that we may store and access cookies on your device. Accept Read More
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT