Play Store: These fake Android antiviruses are malware that can steal your money

There is more and more information on smartphones. Personal information. Professional data. From pictures. From Passwords. But also a access to your bank accounts. You can manage your money very easily, either through your web browser (eg Chrome) or through a special application. And some hackers can take advantage of this access to gain access to your bank accounts.

To do this, they can inject malicious code into a web page. But on Android, the easiest way is to go through an app. Some even manage to circumvent Google’s vigilance. Results : Some software available in Play Store contains malwareIncluding Trojans. These are stored in the background, spying on your activity and relaying information to hackers.

Sharkbot impersonates an antivirus to access your bank accounts

One of them was discovered by Italian cybersecurity experts in October 2021. Cleafy Threat Intelligence. His name shark robot. And its operation is quite similar to Teabot and FluBot, which we talked about in our columns in January 2022. However, the method of propagation has changed recently. Indeed, according to NCC-GroupAn American company specializing in computer security is now available in the source code of various apps on the Play Store.

Ironically, Sharkbot was discovered in four “antivirus” software programs that were supposed to protect their users against malware. This Super Cleaner Antivirus, Atom Clean Booster, Alpha Antivirus and Powerful Cleaner Antivirus. As of this writing, the first two have been removed from the French Play Store. But the other two are still there. They almost accumulate between 60,000 installations. So, if you have one of these, delete it and change your access credentials to your online accounts.

If you’ve given them all the necessary permissions, these apps can fully monitor your banking app (including keylogging to reconfigure your password) to impersonate you and transfer funds. This isn’t the first time Android malware has passed through an antivirus. Cybersecurity experts have been revealing these regularly for several years.

Source: NCC-Group