A new malware is wreaking havoc on the Google Play Store. Called Fleckpe, it hides in Android apps in order to implement its malicious plan, namely: to subscribe users to paid services behind their backs.
The warnings multiplied in April. In particular, we have denounced 36 Android apps infected with advertising-spreading and data-stealing malware. In the aftermath, we also reported the existence of 38 malware-ridden apps. At the beginning of May, Kaspersky researchers are focusing on the dangerousness of the Fleckpe malware.
Active since 2022, it has infected at least 11 rather popular Android applications (image editors, wallpapers, beauty) since they have been downloaded nearly 620,000 times. But what is its modus operandi? When someone installs the infected application, the malware silently activates its malicious payload by subscribing the user to paid subscriptions or services.
Read > This dangerous malware targets your password managers, here is its name and how to avoid it
11 Popular Android Apps Have Insidious Malware
Some are owned by third parties, giving hackers a slice of the pie. But the crooks also have their own subscription services, which allows them to get the full amount paid.“All apps had been removed from the market at the time of our report, but hackers may have deployed other yet undiscovered apps, so the actual number of installs may be higher”points out Kaspersky.
This malware mainly affected Thailand, Malaysia, Indonesia, Singapore and Poland. But you may have been infected after downloading one of the following applications:
- Beauty Camera Plus
- Beauty Photo Camera
- Beauty Slimming Photo Editor
- Fingertip Graffiti
- GIF Camera Editor
- HD 4K Wallpaper
- Impressionism Pro Camera
- Microclip Video Editor
- Night Mode Camera Pro
- Photo Camera Editor
- Photo Effect Editor
The offending apps have been removed from the Play Store. However, you will have to manually uninstall them from your phone if you had downloaded them. Also scan your OS with antivirus to clean any residual malicious code.
Source : Kaspersky
