Malicious Apps Hard to Stop
Google continues to strengthen their policies and efforts to keep malicious apps out of their Play Store. In fact, Google has stopped over 790,000 app submissions before they were ever published. On top of that, they also offer Google Play Protect, which is a built-in malware protector for Android devices. Nonetheless, hackers are still finding ways into the Play Store and user’s devices. Recently, cybersecurity researchers at Check Point Research were able to identify a new malware family. The malware, dubbed Tekya, was detected in 56 apps ranging from cooking apps, calculators and translators to apps specifically designed for children such as racing games and puzzles. Some weren’t just benign looking applications but actual clones of legitimate apps.
Tekya Imitates User Actions
The new malware family is able to alter Androids’ native code, which is configured to run only on Android devices. As a result, Tekya avoids detection by Google Play Protect. On top of that, Tekya also went undetected by antivirus products such as VirusTotal. Once installed, the malware utilizes the MotionEvent functionality on Android phones to simulate users tapping on ads and banners. This is to create false clicks to generate revenue from ad agencies like Google’s AdMob, Facebook, AppLovin’ and Unity. This is known as “mobile ad-fraud”.
Infected Apps Need Manual Removal
After being notified, Google immediately removed the malicious apps from their store. However, users who have already installed one or more malicious apps need to manually remove them and ensure that they have installed the latest security patches. Check Point published the full list of infected apps on their website. Good to know: a sudden rise in data and battery usage or a phone that starts lagging, is usually a sign that something is amiss. This is because the malware is constantly using the device. If you recently installed an app, this might be the culprit. Several tools are available to better protect your privacy on your smartphone.
