Apps with 1.5M installs on Play Store send your data to China ⚠

Apps with 1.5M installs on Play Store send your data to China

Researchers discovered two malicious apps on Google Play with over 1.5 million installation

[{"selector":"#anim-1844e08e-b004-4891-9989-11550f711e7e","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-58128a6b-35b1-4138-8b5b-b4e80d570e10","keyframes":{"transform":["translate3d(0px, 125.94982%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The apps can launch without any interaction from the user to steal sensitive data and send it to China.

[{"selector":"#anim-a293d01f-4a30-43b4-b915-3d94018dde2c","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9df7dafb-9540-4143-90eb-3cd2c1f1a6eb","keyframes":{"transform":["translate3d(0px, 113.38243%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

Despite being reported to Google, the two apps continue to be available in Google Play.

[{"selector":"#anim-b88ae4d9-b55f-4ec5-84ae-ca4e1bc499dc","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-7c2a92d1-70ea-47b1-99ea-6accc9f4592c","keyframes":{"transform":["translate3d(0px, 132.40142%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

File Recovery and Data Recovery has at least 1 million installs.

[{"selector":"#anim-45bbf889-fea5-406f-b08e-935f939068dc","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-70fe72b6-8a52-4ee7-a14a-24c8e32bc494","keyframes":{"transform":["translate3d(0px, 162.68517%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The install count for File Manager reads at least 500,000

[{"selector":"#anim-4cef55af-90c1-474a-be93-9bfc62bd2ba8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9738f948-a861-42af-bfed-a68a22ce1535","keyframes":{"transform":["translate3d(0px, 154.93829%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

Google stated to BleepingComputer: "These apps have been removed from Google Play. Google Play Protect protects users from apps known to contain this malware on Android devices with Google Play Services, even when those apps come from other sources outside of Play."

[{"selector":"#anim-0b0ffac0-442c-4fd9-a710-0cc845ebde41","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-31706ae9-7a6d-4f07-a0c4-0088191d299e","keyframes":{"transform":["translate3d(0px, 111.65358%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

Stories

[{"selector":"#anim-b404abb1-4915-4fec-be88-4168b3cef6b7","keyframes":{"opacity":[0,1]},"delay":100,"duration":800,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-e818f086-cadc-4462-9aa2-88e7335393c2","keyframes":{"transform":["translate3d(-100%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":100,"duration":800,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a8830a93-cc8a-47ef-a69c-040abae750ba","keyframes":{"opacity":[0,1]},"delay":0,"duration":800,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8e1c6e55-d23f-4d34-8b20-8c6a0be069e4","keyframes":{"transform":["translate3d(-100%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":800,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-287bf617-f316-4b32-b7a0-b7850c040c49","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5a7c3e34-4dd5-433f-94f9-4fdf952e3424","keyframes":{"transform":["translate3d(0px, 588.60015%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-939e0f89-1a3c-4db7-8f4e-9d87863b9e66","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-59341315-7bcf-492d-be5a-1c0e6efc909a","keyframes":{"transform":["translate3d(0px, 361.32750%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-99a45108-212e-4d6a-b12f-fcfd142ab9f2","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5f4e5be9-e9cd-4774-a943-0d4c69074f2d","keyframes":{"transform":["translate3d(0px, 1580.07548%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9f732bc4-1130-48d6-be9f-42d5e1503154","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6c9b80d6-a40f-4175-a471-c9c9f5783b6f","keyframes":{"transform":["translate3d(0px, 692.29404%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b4e02e5d-4d7c-437e-afcb-e13cf2580b48","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d878ecd5-1262-4708-9183-92e43a37f8f6","keyframes":{"transform":["translate3d(0px, 1011.11035%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6fcb5b0c-e330-4ec6-87f5-ebdcba859e1a","keyframes":{"opacity":[0,1]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-268104c6-34ad-4a02-8eb8-a6a8eae4a0c5","keyframes":{"transform":["translate3d(0px, 424.55205%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":1200,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b8812955-2ebf-4dea-9a90-9d089ca542f2","keyframes":{"opacity":[0,1]},"delay":0,"duration":2000,"easing":"cubic-bezier(0.4, 0.4, 0.0, 1)","fill":"both"}] Story 1 Story 2 ..................................................