The SharkBot banking Trojan has reappeared in the Google Play Store, disguised as an antivirus and cleaner app. Security researchers from CyberNews write: Android users should think twice before downloading free apps to clean their phones and "protect" them from viruses – because many of them contain data trackers and some even appear to include links to potentially malicious domains.
Fox-It had already discovered the SharkBotDropper in the Google Play Store in February 2022. The Trojan posed as a fake Android antivirus and cleaner. Now the security researchers have
discovered a new version of this dropper in the Google Play Store.
This new dropper does not rely on permissions to automatically install the Sharkbot malware dropper, security researchers say. Instead, this new version of the Trojan asks the victim to install the malware as a fake update for the antivirus program in order to stay protected from threats.
Security researchers have found two SharkbotDopper apps in the Google Play Store, installed 10,000 and 50,000 times respectively. The apps in question, "Mister Phone Cleaner" and "Kylhavy Mobile Security," have a combined 60,000 installs and primarily target users in the UK, Italy, Spain, Australia, Poland, Germany, the US, and Austria.
