New Malware Could Infect 36.5 Million Android Users Globally

As many as 36.5 million Android users may have been infected by an advertising fraud malware, thought to be the largest malware campaign ever.

With the business world still recovering from the fallout caused by the “WannaCry” ransomware attack, a new threat has arisen. Targeting 10s of millions of Android phone users on one of the world’s most popular app marketplaces, where it has lurked for years.

The Malware campaign dubbed “Judy” after one of the infected applications, is an auto-clicking adware which was found on 41 applications developed by a Korean company and spread throughout Google Play Store, one of the world largest application marketplaces.

The malware uses infected devices to generate large amounts of fraudulent clicks on advertisements, generating revenue for the perpetrators while severely hindering the performance of infected mobile devices.

The malicious application has been spread through between 4.5million and 18.5 million downloads, some of the infected applications have been available to download from Google Play Store for several years. It is unclear how long the malicious code has existed inside the apps, and therefore the actual numbers remain unclear.

Several other apps from different developers also contained the same malware, possibly through borrowing code knowingly or unknowingly. The oldest infected application on the store was last updated in April 2016, which means the malicious code has remained hidden for at least a year undetected.

These apps also had as many as 18 million downloads, meaning the total spread of the malware may have reached between 8.5 and 36.5 million users.

Judy managed to bypass, Google Play’s protection, by being implemented as a benign piece of code inside of the app. Once the user had downloaded the application it silently downloads a receiver which connects to its command center and downloads a malicious payload. Once the malicious payload is on the devices the malware will automatically activate.

The malware itself imitates an internet browser, which clicks adverts when users are browsing the internet or playing a game. The fraudulent clicks generate a large revenue for the perpetrators, especially since the malware reached a presumably widespread of people. At this moment, it appears nothing has been stolen from users. But the secret gateway it creates could be used to steal credit card details and other sensitive information from a phone,

Google Play Store confirmed today that they had pulled down all policy violating applications from the report.

Android currently makes up around 75% of Thailand’s mobile phone market share. Many varieties of malware are able to transfer inside networks like offices and coffee shops. If you think you or your business is infected with malware or ransomware, contact Aware today info@aware.co.th.

Other Applications that contained the Judy virus Included:

Credit: CheckPoint