Security News > 2023 > August > Malicious Apps Use Sneaky Versioning Technique to Bypass Google Play Store Scanners

Threat actors are leveraging a technique called versioning to evade Google Play Store's malware detections and target Android users.

Earlier this May, ESET discovered a screen recording app named "iRecorder - Screen Recorder" that remained innocuous for nearly a year after it was first uploaded to the Play Store before malicious changes were introduced sneakily to spy on its users.

Another example of malware using the DCL method is SharkBot, which has repeatedly made an appearance on the Play Store by masquerading as security and utility apps.

"In an enterprise environment, versioning demonstrates a need for defense-in-depth principles, including but not limited to limiting application installation sources to trusted sources such as Google Play or managing corporate devices via a mobile device management platform," the company said.

The findings come as ThreatFabric revealed that malware purveyors have been exploiting a bug in Android to pass off malicious apps as benign by "Corrupting components of an app" such that the app as a whole remains valid, according to KrebsOnSecurity.

To mitigate any potential risks, it's recommended that Android users stick to trusted sources for downloading apps and enable Google Play Protect to receive notifications when a potentially harmful app is found on the device.

News URL

https://thehackernews.com/2023/08/malicious-apps-use-sneaky-versioning.html