Clicker trojan found in Android apps with over 100M installs

Researchers found a clicker Trojan bundled with over 33 apps distributed through the Google Play Store and downloaded by Android users over 100 million times.

The malware was designed as a malicious module added to seemingly harmless applications such as audio players, barcode scanners, dictionaries, and a host of other various types of ordinary software most people would install on their Android devices.

These apps were fully functional as Doctor Web researchers found and didn’t show any warning signs within their interface, while also not exhibiting any of the weird behavior most malicious applications display like hiding their icon after installation or requesting way too many permissions compared to the tasks they were designed to perform.

Clicker Trojans are a type of malware designed to stay active in the memory of infected devices and perform various ad fraud-related tasks in the background such as opening web pages without the victim’s knowledge.

Subscribes victims to premium services

The clicker Trojan dubbed by the researchers Android.Click.312.origin would only activate 8 hours after the apps that contained were launched to evade detection.

Subsequently, another variant was also found while analyzing this malicious campaign, which got named Android.Click.312.origin.

After launching on one of the compromised Android devices, the malware would immediately start collecting system information such as:

All this information and more is packed and sent to the malware’s command and control (C2) server which, in turn, will transmit back commands and new modules to be used, for instance, “to register a broadcast receiver and a content observer, which Android.Click.312.origin uses to monitor the installation and updates of applications.”

Once the user installs a new app on the infected device via the Play Store or from an APK installer, the Trojan will send info and technical data on the device and the newly installed app to its C2 server which sends back URLs to open in a browser, an invisible WebView, or in the Play Store.

“Thus, depending on the settings of the command and control server and the instructions it sends, the trojan can not only advertise applications on Google Play, but also covertly load any websites, including advertisements (even videos) or other dubious content,” the researchers found.

As an example, some users reported on Google’s Play Store that they were “automatically subscribed to expensive content provider services” after installing applications containing the Android.Click.312.origin clicker Trojan.

Doctor Web’s researchers found the clicker Trojan within the apps listed in the table below, which they reported to Google. The company removed several of the reported apps, while a number of them got updated and had the malicious module removed.

The researchers provide detailed information on what information the clicker Trojan sends to its C2 servers, as well as the commands and settings it receives from its operators.

Additionally, Doctor Web’s research team also advises developers to “responsibly choose modules to monetize their applications and not integrate dubious SDKs into their software.”

Source: BleepingComputer