Researchers have caught eight malicious Android apps in the official Google Play app store marketplace distributing a new malware family. The “Haken” malware exfiltrates sensitive data from victims and covertly signs them up for expensive premium subscription services.
The eight apps in question, which have since been removed, had collectively been downloaded 50,000 times. The apps were mostly camera utilities and children’s games, including “Kids Coloring,” “Compass,” “qrcode,” “Fruits coloring book,” “soccer coloring book,” “fruit jump tower,” “ball number shooter” and “Inongdan.” The apps legitimately function as advertised – but in the background covertly perform an array of malicious functions.
“Haken has shown clicking capabilities while staying under the radar of Google Play,” said researchers with Check Point Research, in an analysis on Friday. “Even with a relatively low download count of 50,000+, this campaign has shown the ability that malicious actors have to generate revenue from fraudulent advertising campaigns.”
The downloaded Haken malware is what researchers call “clicker” malware, meaning that it mimics the user and clicks on anything that appears on the device’s screen. The impact of this on victims is two-fold: First, downloaded apps are able to sign users up for premium subscription services without them knowing. Second, this malware can access any sensitive information visible on the mobile screen – from work emails to work conversations over messaging apps.