Malicious Malware Threatens 50 Apps on Google Play Store
JAKARTA — Android malware called Novoice has reportedly infected around 2.3 million devices. The deployment is carried out through more than 50 applications available on the Google Play Store. Applications infected by this malware look normal and function as promised, for example cleaning applications, photo galleries, to games. Not asking for suspicious permission, many users are not aware that the application carries a dangerous threat.
Research from McAfee found that after the application runs, malware will try to take over the system by utilizing the old security vulnerabilities on Android. If successful, malware can get full (root) access to the device. With this access, the perpetrator can control the device without the user’s knowledge, install or delete the application secretly and collect various important data from the phone.
Interestingly, this malware does not target certain areas such as Beijing and Shenzhen in China, possibly to avoid tracking by local authorities. Bleeping Computer reports that Novoice uses advanced techniques to hide itself. Malicious code is inserted in a normal-looking file, even camouflaged in the image using special techniques.
Once active, the malware will connect to the attacker’s server to receive further instructions. In addition, this malware is also able to collect device information such as the Android version, installed applications, and others. This malware can also adjust the attack method according to the condition of the device and reinstall itself if it is deleted. Even in some cases, the malware persists even though the device has been reset to factory settings.
Targeting WhatsApp data
One of the most dangerous abilities of this malware is stealing data from WhatsApp. Malware can retrieve important information such as encryption data, user phone numbers to account backup information. The data is then sent to the attacker’s server, so they can copy or clone the victim’s WhatsApp account on another device.
This application containing malware has now been removed from the Google Play Store after being reported by McAfee. In addition, Google stated that Android devices that have been updated since May 2021 are relatively safe from this attack. Security features like Google Play Protect also help remove malicious apps and prevent new installations.
How to protect yourself
To avoid similar threats, users are advised to:
- Always update the Android system to the latest version
- Downloading apps only from trusted sources
- Avoiding applications from unknown developers
If you have ever installed a suspicious application, there is a possibility that the device is already infected, it needs further handling.
