No sooner did we report on Wednesday the presence of a new batch of scammy Android apps that had to be removed from the Google Play Store (but not before racking up some 382 million downloads), than yet another wave of such apps has emerged to be aware of. And to remove from your phone, if you have any of them.<\/span><\/p>\n Two separate teams of researchers uncovered a pair of nasty apps and Android activity, some of which is among the worst we\u2019ve seen. First, a new batch of nine apps (since removed from the Google Play Store after racking up about 470,000 downloads) comes via a report from <\/span>Trend Micro<\/span> that pinpoints a number of sinister purposes for this collection of apps that disguise themselves as seemingly anodyne utilities, with names like Rocket Cleaner and LinkWorldVPN. However, the Trend Micro researchers warn that the apps do everything from quietly connect to servers to download up to 3,000 pieces of malware \u2014 and that some can even log in to the unaware users\u2019 Facebook and Google accounts for ad fraud purposes.<\/span><\/p>\n The apps in question include the following:<\/p>\n The Trend Micro report suggests these apps originated from China, and that once a user installed them they connected to a server to do things like posting fake reviews and logging into the accounts we noted above. Additionally, they could get users to unwittingly disable the Play Protect Android malware scanner, among other nefarious acts.<\/span><\/p>\n The apps have been removed from the Google Play Store, but definitely make sure to delete any of these if you still have them on one of your devices.<\/p>\n Researchers from the <\/span>Cofense Phishing Defense Center<\/span>, meanwhile, have also uncovered a separate but even more sinister effort \u2014 a phishing campaign targeting Android devices with unsigned Android applications allowed on the device. <\/span>According to a new report from the center, this is an effort to infect devices with Anubis, \u201ca particularly nasty piece of malware that was originally used for cyber espionage and retooled as a banking trojan.\u00a0<\/span><\/p>\n \u201cAnubis can completely hijack an Android mobile device, steal data, record phone calls, and even hold the device to ransom by encrypting the victim\u2019s personal files. With mobile devices increasingly used in the corporate environment, thanks to the popularity of BYOD policies, this malware has the potential to cause serious harm, mostly to consumers, and businesses that allow the installation of unsigned applications.\u201d<\/span><\/p>\n This malicious campaign presents users with an email that includes an attachment pretending to be an invoice. When the user opens the attachment, they\u2019re shown a screen asking them to enable \u201cGoogle Play Protect.\u201d After clicking OK, however, that approval instead grants the app a number of secret, very bad approvals \u2014 while also, ironically, actually disabling the real Google Play Protect.<\/span><\/p>\n Other capabilities that are thus enabled include the ability to capture screenshots, change administration settings, record audio, steal contact lists and lock the device. As if that wasn\u2019t enough, there\u2019s also a ransomware component to this effort. A Cofense researcher told Ars Technica<\/em> that a ransomware module can be added via this campaign and enabled remotely once an attacker has taken everything they want from the phone and decided to simply encrypt it for ransom.<\/span><\/p>\n Check the Cofense report here for a list of apps this campaign targets (it\u2019s quite a long list). \u201cUsers who have configured their Android mobile device to receive work-related emails and allow installation of unsigned applications face the most risk of compromise,\u201d the report concludes.<\/p>\n \u201cWith the increased use of Android phones in business environments, it is important to defend against these threats by ensuring devices are kept current with the latest updates. Limiting app installations on corporate devices, as well as ensuring that applications are created by trusted developers on official marketplaces, can help in reducing the risk of infection as well.\u201d<\/p>\n \n\tImage Source: PixieMe\/Shutterstock<\/span><\/span><\/p>\n \n\t\tAndy is a reporter in Memphis who also contributes to outlets like Fast Company and The Guardian. When he\u2019s not writing about technology, he can be found hunched protectively over his burgeoning collection of vinyl, as well as nursing his Whovianism and bingeing on a variety of TV shows you probably don\u2019t like.\t<\/p>\n<\/div><\/div>\n\n
![](\"http:\/\/ww-vb.mine.nu\/w108\/wp-content\/uploads\/2020\/02\/1580530133_630_All-four-major-US-wireless-carriers-are-suffering-outages-right.png\")
<\/div>\n