Android malware infects 60+ Google Play apps with 100 million downloads
A new Android malware called “Goldoson” has infiltrated Google Play and has been found in 60 legitimate apps with a total of 100 million downloads.
The malicious malware component is integrated into a third-party library that developers accidentally included in all sixty apps, reports BleepingComputer.
The Android malware discovered by McAfee’s research team is capable of collecting a variety of sensitive information, such as information about a user’s installed apps, WiFi and Bluetooth devices, and GPS locations.
According to the report, it can also commit ad fraud by clicking ads in the background without the user’s consent.
When a user runs an application containing Goldoson, the library registers the device and retrieves its configuration from an obscure remote server.
The settings specify which data-stealing and ad-clicking action Goldson should perform on the infected device and how often.
Infected Apps
- L.POINT with L.PAY (10M+) Updated
- Swipe Brick Breaker (10M+)
Removed - Money Manager Expense & Budget (10M+) Updated
- TMAP (10M+) Updated
- Lotte Cinema (10M+) Updated
- Genie Music (10M+) Updated
- Cultureland version 2 (5M+) Updated
- GOM Player (5M+) Updated
- Megabox (5M+)
Removed - LIVE Score Real-Time score 5M+Updated
- Pikicast (5M+)
Removed - Compass 9: Smart Compass (1M+)
Removed - GOM Audio – Music, Sync lyrics (1M+) Updated
- TV – All About Video (1M+) Updated
- Guninday (1M+) Updated
- Item mania (1M+)
Removed - LOTTE WORLD Magicpass (1M+) Updated
- Bounce Brick Breaker (1M+)
Removed - InfiniteSlice Infinite Slice (1M+)
Removed - Norae bang (1M+) Updated
- SomNote – Beautiful note app (1M+)
Removed - Korea Subway Info: Metroid (1M+) Updated
- GoodTVBible (1M+)
Removed - Happy Mobile Happy Screen (1M+) Updated
- UBhind: Mobile Tracker Manager (1M+)
Removed - Mafu Driving Free (1M+)
Removed - Girl singer WorldCup (500K+) Updated
- FSP Mobile (500K+)
Removed - Audio Recorder (100K+)
Removed - Catmera (100K+)
Removed - Cultureland Plus (100K+) Updated
- Simple Air (100K+)
Removed - Lotteworld Seoul Sky (100K+) Updated
- Snake Ball Lover (100K+)
Removed - Play Geto (100K+)
Removed - Memory Memo (100K+)
Removed - PB Stream (100K+)
Removed - Money Manager (Remove Ads) (100K+) Updated
- Inssaticon – Cute Emoticons (100K+)
Removed - ECloud (100K+) Updated
- SCinema (50K+) Updated
- Ticket Office (50K+) Updated
- Lotteworld Aquarium (50K+) Updated
- Lotteworld Water Park (50K+) Updated
- T map for KT, LGU+ (50K+)
Removed - Random number (50K+) Updated
- AOG Loader (10K+)
Removed - GOM Audio Plus – Music, Sync l (10K+) Updated
- Swipe Brick Breaker 2 (10K+)
Removed - Safe Home (10K+)
Removed - Chuncheon (10K+)
Removed - Fantaholic (5K+)
Removed - Cinecube (5K+) Updated
- TNT (5K+)
Removed - Bestcare Health (1K+)
Removed - InfinitySolitaire (1K+)
Removed - New Safe (1K+)
Removed - Cashnote (1K+)
Removed - TDI News (1K+)
Removed - Eyesting (500+)
Removed - TingSearch (50+)
Removed - Krieshachu Fantastic (50+)
Removed - Yeonhagoogokka (10+)
Removed
In addition, according to the report, the data collection mechanism is usually set to activate every two days, sending a list of installed applications, geographic location history, MAC addresses of devices connected via Bluetooth and WiFi, and other information to the C2 server.
The amount of data collected is determined by the user rights granted to the infected application during installation and the Android version.
Although Android 11 and later versions are better protected against arbitrary data collection, the researchers found that Goldoson had sufficient rights to obtain sensitive data in 10 percent of apps even in newer versions of the operating system, the report states.
Ad revenue is generated by downloading the HTML code and inserting it into a custom hidden WebView and using it to perform multiple URL visits.
There is no indication of this activity on the victim’s device.
In January, Google’s Threat Analysis Group shut down thousands of accounts linked to a group called “Dragonbridge” or “Spamouflage Dragon” that was spreading Chinese disinformation on various platforms.
According to the tech giant, Dragonbridge receives new Google accounts from crowdsourced account sellers, and at times they have even used accounts previously used by financially motivated actors to publish disinformation videos and blogs.
Read all the Latest Tech News here.
