Hidden malware inside Google Playstore

After RANSOMWARE and CLOAK & DAGGER ,Researchers discovered another widespread malware campaign on Google Play store. The malware, “Judy”, is an auto-clicking adware which was found on 41 apps developed by a Korean company- KINIWINI, which was registered on Google Play as EniStudio.

According to experts, the malware has a reach of anywhere between 8.5 million and 36.5 million users worldwide from 41 different apps on the Google Play Store, it has been available on Google Play store for many years, and regularly updated until now. Similar to previous malware that has infiltrated Google Play, such as FalseGuide and Skinner, Judy relies on the C&C server for its operation, expert says. If a user downloads, the app establish a connection with the C&C (command and control) server. The server replies with the actual malicious payload, which includes JavaScript code, and URLs controlled by the malware author.

Which silently opens the website domains in a hidden webpage and proceeds to automatically click on advertising  banners to make money via Google Ads. It is an illegal way of earning money through Google Ads.

The oldest app was last updated in April 2016, that means it is undetected for a very long period of time by Google. These apps don’t look malicious on its appearance and have millions of downloads and good reviews.

The app list of malware contents are given below:

Fashion Judy: Snow Queen Style, Vampire style, Frozen Princess, teacher style,etc.

Animal judy: persian cat care, dragon care ,teddy bear care , rabbit care, etc.

Chef judy: Halloween cookies, triangular kimbap , jelly maker , chicken maker, etc.

They add that the apps containing the malware have been remove from the Play Store by Google following a warning from tech experts in recent. In future be safe while downloading from playstore, always download from trusted and authorized app makers.

Stay updated with latest happenings of tech world on the go with Technobugg App, on Android and Windows.