Necro Trojan Detected in Google Play Apps and Modded Versions of Spotify, WhatsApp

According to security researchers, the attackers have been targeting some Google Play applications and unofficial versions of popular apps to spread a dangerous malware. The alleged Necro Trojan can log keystrokes, steal sensitive data, install more malware, and execute remote commands. Google has been able to identify two apps in the Google Play application store that carry this malware. In addition, modded android application packages (APKs) of applications such as Spotify, WhatsApp, and some games, such as Minecraft, were also seen to spread the trojan.

Google Play Apps, Modded APKs Used to Spread Necro Trojan

First, a trojan belonging to the Necro family was detected when the malware infected a popular app called CamScanner, which makes PDFs. This application had more than 100 million downloads in Google Play with an official version, but before that, it posed a risk to all the users involved. A security patch was fixed then.

As Kaspersky researchers post, the new version of the Necro trojan has been found in two apps bearing the Google Play trademark. The first of these apps is the Wuta Camera application that has been downloaded more than 10 million times to-date, while the second one is Max Browser downloaded over a million times. The researchers confirmed that the infected apps were removed from Google after having contacted the latter.

The main concern here is too many unofficial, ‘modded’ versions of popular applications that exist on a large number of third-party websites. They can be downloaded and installed unknowingly by users on their Android, thus infesting it. Some of the identified APKs include modified versions of Spotify, WhatsApp, Minecraft, Stumble Guys, Car Parking Multiplayer, and Melon Sandbox, where modded versions promise users features from paid subscription services.

Evidently, the attackers are using different attack vectors against the users. For instance, the Spotify mod contained an SDK, which produced several modules of advertising as testified by the researchers. It was also using a command-and-control (C&C) server to deploy the trojan payload in case the user accidentally touched the image-based module.

In the case of WhatsApp mod, it was also determined that attackers had overridden Google’s Firebase Remote Config cloud service and used it as C&C server. Interacting with the module in this case would deploy and execute the same payload.

The malware, after deploying, could download executable files, install third-party applications, and open arbitrary links in invisible WebView windows to execute JavaScript code,” said the Kaspersky post. Moreover, the malware could also subscribe the victim to expensive paid services without his knowledge.

The apps in Google Play have already been deleted, but users are advised to be much more careful and watchful in the process of downloading Android apps from third-party stores. They should avoid downloading or installing any application or files if they do not trust the marketplace.