Google Play suffers malware attack on Android devices
Google Play has been subject to what is possibly the largest malware campaign ever found on the app store, prompting the removal of 41 apps, according to researchers from cybersecurity software firm Check Point. The company discovered the infected apps, which forced Android users to click on ads, had been downloaded up to 18.5 million times. Check Point also found that the malware had been developed by South Korean company Kiniwini, registered on Google Play as ENISTUDIO.
by Laurie Sullivan @lauriesullivan, May 26, 2017

Dubbed as "possibly the largest malware campaign found on Google Play," Check Point researchers have found another widespread campaign in Google's Play app store that has forced Google to remove 41 apps.

The malware-infested apps were downloaded up to 18.5 million times and forced Android users to click on ads. Check Point, a cyber security software company, dubbed the malware "Judy," developed by a Korean company, Kiniwini. The company is registered on Google Play as ENISTUDIO corp.

Check Point said some apps were discovered that had been living on Google Play for several years, but all were recently updated.

Google's technology, developed to keep adware out of the store, was not able to pick up on the malware as it was downloaded after installation. When the code was added to the apps, it would open Web pages in the background through software that imitated a PC browser.

advertisement advertisement

Once the targeted Web site has been launched, the malware uses the JavaScript code to locate and click on banners from the Google ads network.

Upon clicking the ads, the malware author receives payment from the Web site developer, which pays for the illegitimate clicks and traffic.

The JavaScript code locates the targeted ads by searching for iframes which contain ads from Google ads network, according to Check Point analysts.