After Google kicked them out of the Play Store
If you're an Android user concerned about data privacy and overall mobile security, you're probably not going to be shocked to hear that yet another list of malicious apps has come to light.
In the past couple of months alone, we've warned you more times than this writer can count on the fingers of one hand of various scary threats to everything from your bank account to your passwords to all kinds of financial services and money transfer platforms again.
But while some of these extremely dangerous trojans were carefully hidden inside moderately popular apps or sketchy apps made to look legit to an unsuspecting eye, the absolutely massive data-harvesting operation uncovered by a group of security analysts at a company called AppCensus is "special" and surprising (even to us) for a number of reasons.
The culprits are both diverse and widely used around the worldFirst and foremost, the number of possible victims is simply staggering, at 60 million... and counting. That's right, "at least" 60 million people are estimated to have installed the malicious apps listed below, according to The Wall Street Journal:
• Speed Camera Radar
• Al-Moazin Lite (Prayer Times)
• Wi-Fi Mouse (remote control PC)
• QR & Barcode Scanner (developed by AppSource Hub)
• Qibla Compass - Ramadan 2022
• Simple weather & clock widget (developed by Difer)
• Handcent Next SMS-Text with MMS
• Smart Kit 360
• Al Quran MP3 - 50 Reciters & Translation Audio
• Full Quran MP3 - 50+ Languages & Translation Audio
• Audiosdroid Audio Studio DAW
As you can notice, this is a particularly... eclectic roster of titles you should probably try to avoid using at all costs, including a few incredibly popular Muslim prayer apps, but also fairly generic-sounding QR code readers, weather tools, and messaging services.
These are the types of data targeted by this huge malware-spreading campaign.And just in case that 60 million+ figure fails to raise all the hairs on your body in sheer terror, it's worth pointing out that other unnamed apps were also found guilty of carrying the same potentially mischievous software as all the above. While it's unclear why these other apps are unnamed, Google did apparently do the right thing across the board after being informed of the "issue" back in October 2021.
Specifically, all the (named and unnamed) Android apps found to be spying on their users were reportedly deleted from the official Play Store as of March 25, which however didn't stop them from returning at some point between then and the time of this writing.
Wait, they're back already?!Believe it or not, all of those 11 apps (and possibly many more) are running free as we speak, although for fairly obvious reasons, we've chosen not to link to their active Google Play listings and we recommend you refrain from downloading them anytime soon.
While Google promises to have verified them as no longer invasive and problematic before relisting them, we feel like it's a matter of principle (and common sense) to look for alternatives with a... superior reputation. More importantly, those who've installed these apps before AppCensus made its discovery and published the conclusions of its research should definitely hit "delete" despite a recent halt of their unauthorized data-collecting behavior.
To be perfectly clear, we're talking about all kinds of sensitive information here, ranging from email addresses to phone numbers, passwords, and perhaps scariest of all, precise GPS location history, which a shady company called Measurement Systems paid presumably big money to harvest via a third-party SDK (software development kit) integrated into the apps listed above.
Unsurprisingly, Measurement Systems denies all wrongdoing allegations, even though the evidence is pretty thorough and quite damning.
source
