Google always try to keep a check on its app store and other services to keep them secure for users. Still, some potentially harmful Malware find their way to get into the system and Joker Malware is one such infamous malware. The virus came in knowledge in 2019 and earlier this year when it infected around 1700 apps on Google Play Store and now once again, it made its way to the app store. Recently, Google deleted 11 infected apps from the Play Store. Check the list of 11 Joker malware infected apps removed from Google Play Store and detailed information about this virus in this article to keep your info safe.
What is Joker Malware?
Joker malware is an infamous malware came in presence last year and earlier this year on Google Play Store. The malware steals contacts and messages to steal users’ money by subscribing to the paid services online using the OTP without their consent. In this way, money gets deducted from the users’ bank account/credit cards, and they don’t understand the reason behind these transactions.
How does Joker Malware steal your information?
Joker Malware always finds a way to get integrated with the apps by making some small changes in the code. When users install such apps, the malware interacts with ads without users knowledge and steal their crucial information like SMS, including OTP, card details etc. to make online payment of paid apps. It means that users will not be aware that they have subscribed paid apps and money gets deducted from their account.
But this time, two new variants Joker Dropper and Premium Dialer spyware of Joker Malware found in the play store, hiding in some legitimate apps. This time, the Joker Malware adopted an old technique from the conventional PC threat and used it in mobile apps to avoid getting detected by Google.
The new Joker Malware is more advanced and dangerous this time as it has used Notification Listener Service of the app and a dynamic dex file loaded from the C&C to do the registration of the users.
List of 11 Joker malware infected apps removed from Google Play Store
Even after making so many changes to make its way again in the play store, Joker Malware gets detected by the Pradeo security team, which informed google about it.
As per the Checkpoint’s research, the Joker Malware was present in the following 11 apps, which now removed from Google Play Store:
- com.imagecompress.android
- com.contact.withme.texts
- com.hmvoice.friendsms
- com.relax.relaxation.androidsms
- com.cheery.message.sendsms (two different instances)
- com.peason.lovinglovemessage
- com.file.recovefiles
- com.LPlocker.lockapps
- com.remindme.alram
- com.training.memorygame
As per the Check Point report, the Base64 strings were located inside an internal class, instead of being added into the Manifest file, which means the malicious code only needed the device to read the strings, decode them and then load the reflection to infect.
How to Protect your Android phone from Joker Malware Infected Apps?
Though Google has removed the Joker malware-infected apps from the Play Store, the apps can still harm your device and personal information if already installed in your phone. To protect your android phone from Joker Malware like viruses, you must take these precautions:
- You must check all the apps installed in your phone that whether any of them is from the non-trusted developer. If yes, then you must uninstall it immediately.
- Install antivirus in your mobile to secure it from viruses.
- Check your mobile and credit card bills to check discrepancies. If you find any unusual thing, talk to your bank immediately.
- Try to avoid app installations from the third-party sources. If you are installing any app from such sources, you must check about it carefully before installing the app.
Wrapping It Up!
So, this was the list of 11 Joker Malware Infected apps removed by Google Play Store. But the malware is very tricky and thus shall make its appearance again soon on the app store. So, it is recommended to learn about the apps before installing them. Stay safe and protect your information.
This post first appeared on Technoratan - Tidings Told Technically, please read the originial post: here
