Users were given a stark reminder last month that they should exercise the same level of caution when installing apps onto mobile devices as they do when downloading software onto their work PCs.
Three Android apps have since been removed from the app store by Google, but not before they’d managed to infect millions of phones and tablets.
[themecolor]Bogus pop-up ads[/themecolor]
Popular free card game app Durak is the main culprit, having been downloaded up to 10 million times, according to Google Play. The “adware” within the app was causing phony pop-up ads disguised as authentic system notifications; the pop-ups advised users to download new software in order to improve gameplay speed, according to reports.
The recommended software links often automatically installed unwanted apps which would send premium SMS messages or collect vast amounts of personal data without permission. In some cases, Durak functioned normally for as long as 30 days before the harmful malware revealed itself.
[themecolor]Up to 5 million downloads[/themecolor]
Security firm Avast confirmed the other two apps alleged to be involved in the infection of millions of devices include a Russian language IQ test app and a Russian history educational tool, which were downloaded up to five million times and up to 50,000 times respectively, according to Google Play.
Filip Chytry, Avast’s malware analyst, said: “Most people won’t be able to find the source of the problem and will face fake ads each time they unlock their device.”
“I believe that most people will trust that there is a problem that can be solved with one of the app’s advertised ‘solutions’ and will follow the recommended steps, which may lead to an investment into unwanted apps from untrusted sources.”
All three apps have now been suspended. Despite Google Play’s download figures rising into the multi-millions, some experts believe they should be taken with a pinch of salt. Dr Steven Murdoch from University College London, for example, highlighted that many malware authors deliberately exaggerate the amount of downloads to appear more popular.
