As many as 2 million Android users might have downloaded apps that were infected with the FalseGuide malware, security research firm Check Point warned on Monday. Initially thought to be 600,000 users, the number of Android users who have mistakenly downloaded and installed malware on their devices straight from Google Play Store has reached 2 Million. The oldest of the infected apps could have been uploaded to Google Play as long ago as last November, having successfully remained hidden for five months, while the newest may have been uploaded as recently as the beginning of this month.
Once subscribed to this service, FalseGuide can allow the attackers to send messages containing links to additional malware and install them to the infected device, enabling attackers to display illegitimate pop-up ads out of context and generate revenue.
Check Point alerted Google about the presence of the malware, and Google swiftly responded by removing the infected apps from its online app store, they said.The apps were submitted by two fake developer personas: “Sergei Vernik” and “Nikolai Zalupkin.”
The infected apps have the potential of being especially dangerous, they said, as FalseGuide could be utilizing a botnet for nefarious purposes ranging from the sending of adware to conducting a DDoS attack, or even as a way to penetrate a private network.
These high levels are possible because the apps request device admin permission upon downloading. That is an unusual request, and it suggests malicious intent, as it prevents the user from deleting the app. FalseGuide registers itself to a Firebase Cloud Messaging topic with the same name as the app, which allows it to receive additional modules that then create a silent botnet.
“This FalseGuide Malware did a great job of deploying via a few apps users wanted, and when people granted it top administrative privileges during installation, the malware was planted pretty deeply,” said Jim Purtilo, associate professor of computer science at the University of Maryland.
Google so far has responded in the only way it can by removing the infected apps from Google Play. However, given that some of these guides date back to early November, it appears that the company clearly failed to protect its customers.