Spyware Apps on Google Play Threaten Over 1.5 Million Users

Last week, cybersecurity experts at Pradeo made a disconcerting revelation: two spyware applications had managed to infiltrate Google Play. Disguised as innocent file management tools, these malicious apps have jeopardized the security of up to 1.5 million users. The experts promptly alerted Google about this alarming finding before issuing an urgent alert to the public.

The first app is File Recovery and Data Recovery (com.spot.music.filedate) which has already been downloaded by 1 million users. The second app, File Manager (com.file.box.master.gkd) boasts over 500,000 installs.

Both apps make false claims of not collecting user data, concealing their true intentions. Moreover, they brazenly state that, even if data were collected, users would be denied the option to have it deleted — violating data protection laws such as the GDPR.

These spyware apps are recognized as malicious and extensively harvest highly personal data from unsuspecting victims, transmitting it to various destinations primarily in China. The stolen data includes contact lists, media files, user location, mobile country code, network provider name, network code of the SIM provider, operating system version number (which could potentially lead to exploitation of vulnerable systems), and device brand and model.

To increase their chances of success and appear legitimate, the hackers artificially boosted the user population with install farms or mobile device emulators, deceiving users into believing that the apps were trustworthy and popular. However, despite their apparent popularity, they lack any genuine user reviews.

Furthermore, the apps exploit advanced permissions to induce device restarts. This enables the apps to automatically launch and execute themselves upon restart, disregarding user engagement entirely.

If you happen to have these applications installed on your device, it is strongly advised that you delete them immediately. It is important to exercise caution and refrain from downloading applications without reviews, even if they claim to have thousands of users. User reviews often shed light on the true nature of apps and serve as a valuable source of information. Always review and carefully consider the permissions requested by an app before accepting them.