Now Android users are in for a rude awakening yet again as 25 apps from the Google Play Store have been caught spying and stealing user data. Surprisingly, these apps are known to have up to 2 million downloads. Although Google’s best efforts to cleanse the app store and get rid of malicious entities, a French cybersecurity firm called Evina caught these apps red-handed.
Included Apps (Source: Evina)
According to its report, the 25 applications that managed to sneak through Google’s defenses were released by a single group. The malicious applications were modeled after innocent-looking wallpaper apps, flashlight apps, and mobile games. Evina revealed that all these apps were made to steal user data, such as Facebook login credentials.
Evina also explained how the applications manage to steal user data. As users open the app, the malware asks the name of the application, and if it is a Facebook application, the malware launches a browser that loads Facebook in the foreground. Since the Facebook browser shows up in front, the users think the app launched it. Now, as soon as users enter their Facebook credentials into this seemingly harmless Facebook pop-up, the malware executes javascript to retrieve the data and sends it all to their servers. In this way, malicious developers manage to steal data and collect it on their servers without the knowledge of users.
However, if you are an Android user with one of these apps on the phone, you no longer have to worry. After Evina shared its report, Google immediately pulled these apps from the Play Store. The tech giant also disabled the applications at the user end and notified users about these apps through their Play Protect Service.
The apps have reportedly been on the Play Store since 2019 and had gained up to 2 Million downloads in less than a year. Evina managed to catch these apps in the act and informed Google in May. This was followed by an investigation by Google, which took action against them in June.
Conclusion
Unfortunately, this is not the first or the last time Google Play Store will be hounded by malicious apps that exploit user information. In recent months alone, Google has had to kick more than two dozen malware-filled apps with 382 million downloads from the Play Store. In another instance, a weather app was caught collecting sensitive user information and sending it to servers located in China. All these accidents have left a big dent in Google Play Store’s credibility and security. Moving forward, Google will have to take a proactive approach regarding malicious applications on its Store to protect users from security breaches.