More Than 150 Android Apps Tried to Infect Phones with Windows Malware

More Than 150 Android Apps Tried to Infect Phones with Windows Malware

Usually, finding malware in the Google Play Store would be a bad thing. Finding several hundred apps with thousands of downloads would be substantially worse, but in this case, it’s no big deal. The newly discovered malware apps don’t actually contain Android malware — they have Windows malware. Oops.

Security researchers with Zscaler detected the first infected app several days ago, but then more than 150 more with the same signature popped up upon further investigation. As it happens, these apps are carrying the same malicious Windows payload discovered in Android apps last year. This likely isn’t an example of bumbling malware creators loading the wrong code. Rather, the developers were using machines infected by a now-defunct botnet called Ramnit.

The Ramnit botnet first appeared in 2011, but it was taken offline in 2015 by a European law enforcement operation. At its height, Ramnit ran on nearly a million Windows PCs around the world and served a hub for online crime. While the botnet itself is dead, there are still local infections living on PCs around the world. One feature of Ramnit was the way it burrowed into programming platforms. Apps built on these platforms would end up as a carrier of the infection, and that’s what we see appearing in the Play Store.

The malicious iframes.
The malicious iframes.

These Android apps contain malicious iframes that can load a domain with potentially dangerous code. On a Windows machine some years ago, the Ramnit botnet operators could use these domains to infect new computers and increase the size of the botnet. Today, these apps are little more than harmless relics. The 150 apps were mostly low-effort web wrappers and image galleries, and only a handful of developers were represented. It’s likely these multiple developers were actually a single team all using the same infected systems to develop their apps.

Android users need not fear the Ramnit-infected apps for several reasons (even more than usual). Most importantly, this is Windows malware that cannot negatively impact Android devices. There’s no exploit for Android here. In addition, the malicious domains from the iframes were blocked by DNS servers in 2015, a practice called sinkholing. And finally, Google responded to Zscaler’s report by removing all the offending apps. While they weren’t a danger to Android users, malware is malware. Even if you go looking for the apps listed by Zscaler, you’ll just get an error page. The developer accounts associated with the apps appear to be gone as well. Better safe than sorry.

Continue reading

Protect Your Online Privacy With the 5 Best VPNs
Protect Your Online Privacy With the 5 Best VPNs

Investing in a VPN is a smart choice right now, but the options are vast. To help narrow things down a bit, we've rounded up five of our very favorite consumer services.

RISC-V Tiptoes Towards Mainstream With SiFive Dev Board, High-Performance CPU
RISC-V Tiptoes Towards Mainstream With SiFive Dev Board, High-Performance CPU

RISC V continues to make inroads across the market, this time with a cheaper and more fully-featured test motherboard.

The PlayStation 5 Will Only Be Available Online for Launch Day
The PlayStation 5 Will Only Be Available Online for Launch Day

The PlayStation 5 isn't going to be available in stores on launch day, and if you want to pick up an M.2 SSD to expand its storage, you'll have some time to figure out that purchase.

ARMing for War: New Cortex-A78C Will Challenge x86 in the Laptop Market
ARMing for War: New Cortex-A78C Will Challenge x86 in the Laptop Market

ARM took another step towards challenging x86 in its own right with the debut of the Cortex-A78C this week. The new chip packs up to eight "big" CPU cores and up to an 8MB L3 cache.