- Trump accuses Jewish Democrats of having ‘great disloyalty’ or a ‘lack of knowledge’ Tuesday 8:02 PM
- 1 million ‘anonymous’ users of popular porn site exposed in breach Tuesday 6:56 PM
- Khloé Kardashian angers followers with a calorie-counting joke about True Tuesday 6:14 PM
- Spider-Man may no longer be part of the Marvel Cinematic Universe Tuesday 5:28 PM
- Robert De Niro’s company is suing ex-employee for binge-watching Netflix at work Tuesday 4:41 PM
- Intentionally misgendering a character could get you banned from Borderlands 3 Tuesday 4:06 PM
- Facebook pulls Trump re-election ad for targeting ‘strong women’ Tuesday 4:03 PM
- Kamala Harris says she will restore net neutrality if elected Tuesday 3:16 PM
- All 8 of the ‘Rocky’ movies, ranked Tuesday 2:50 PM
- Everything you need to know about the Facebook conservative bias report Tuesday 2:35 PM
- Study links emoji use to more sex Tuesday 2:10 PM
- The chicken sandwich war is in full throttle on Twitter Tuesday 1:47 PM
- Netflix’s ‘Sextuplets’ proves Marlon Wayans is no Eddie Murphy—or even Mike Myers Tuesday 1:31 PM
- Facebook is finally rolling out its clear history tool Tuesday 1:13 PM
- ‘Theater etiquette’ tweets surge after YouTuber cast in ‘Waitress’ Tuesday 12:55 PM
A sneaky Android virus infected apps in the Google Play Store and third-party markets
Infected apps included fakes of popular games like Candy Crush.
Some of Android‘s most popular games have been tainted by a virus installed in fake versions of the games that lets hackers take control of victims’ phones and add them to a botnet, according to new research from the Slovakian security firm ESET.
Infected games posing as Candy Crush, Temple Run, and Plants vs. Zombies 2 are among those on the Google Play Store that were affected by the Mapin virus from the end of 2013 until the end of 2014. The fake version of Plants vs. Zombies 2 alone was downloaded tens of thousands of times over the course of a year while it was infected, after which it was finally pulled from the store.
The fact that Mapin made it onto Google’s official app store means that it fooled Google’s security software, Bouncer, for nearly a year and a half.
Mapin also hit third-party Android software markets, affecting more than a dozen apps there in the last two years. Many of these apps are still available outside of the official Google Play Store.
Nearly 75 percent of infections have hit India, according to the researchers.
The Mapin trojan takes a patient and clever attack route by waiting a full 24 hours before executing, so that the infected games don’t seem responsible for problematic behavior.
Instead, the user is led to believe that the phone itself asking to install new software called Google Play Update or Manage Settings—authoritative names for nefarious tools.
“The average user will be convinced that this is some important update and at some point is likely to install it just to get rid of this notification,” the researchers told the Daily Dot.
After successfully installing itself, the trojan demands administrative privileges from the user so that it can’t be removed. By then, Mapin has connected back to a command-and-control server through which the hackers can pull the strings.
To add insult to injury, the trojan serves advertisements to the user, interrupting every action with full-screen commercials.
To help protect yourself against threats like this, ESET researchers recommend sticking to trustworthy developers and reading app permission requests closely when installing new software. If a request stands out as unjustifiable, something might be wrong.
Clarification: The apps being attacked by the Android/Mapin Trojan are not the actual popular arcade games, but rather fake versions of those apps that are also available in Google Play as well as third-party stores.
Screengrab via Palo Alto Networks/Google Play
Patrick Howell O'Neill is a notable cybersecurity reporter whose work has focused on the dark net, national security, and law enforcement. A former senior writer at the Daily Dot, O'Neill joined CyberScoop in October 2016. I am a cybersecurity journalist at CyberScoop. I cover the security industry, national security and law enforcement.