Story image

ESET discovers fake Prisma apps full of trojans

08 Aug 16

The trojans just keep on coming, as ESET researchers reported fake versions of photo transformation app Prisma on Google Play, just ahead of the official app's launch last month.

The fake versions included trojan downloaders, which affected more than 1.5 million downloads before ESET discovered the apps and helped to remove them from Google Play.

"In the lead up to the launch of an app that is already popular, it’s becoming increasingly common for fake versions of that app to be put on the Google Play store to lure fans and leverage the wave of excitement around the product. By using misleading icons, app names, developer names and even fake reviews, the e-criminals controlling these fake apps make money from displaying ads, fake clicks, money scams or, at worst, ransomware, delivered to the victim via a Downloader Trojan," says Nick FitzGerald, senior research fellow at ESET.

Users were a little too keen for the official app, and fell victim most of the fake apps that had no photo editing features. ESET says the apps used phishing attempts through fake surveys and ads designed to hook users into providing personal details.

The fake requests also included an Android 6.0 update, through a fake login form that captured users' details. The trojans analysed in ESET's lab also stole sensitive information including phone number, operator name, country name and language.

While some apps did have photo editing functionality, they also incorporated scareware to convince users of a malware infection.

The most dangerous downloaders included Android/TrojanDownloader.Agent.GY, which is a malware family that posed a 'serious risk' to more than 10,000 users before the apps were removed.

"It’s never wise or recommended to download a popular app before its official release as the chances of downloading the genuine app are very low, while the risk of downloading a malicious fake is very high. Users need to be aware that even with all of Google’s security mechanisms behind the Google Play store, e-criminals often use very similar icons, app names, subscriptions and even screenshots to confuse users," FitzGerald explains.

FitzGerald recommends users protect their Android devices by adhering to the following guidelines

  • Download apps only from reputable sources
  • Don't take positive user reviews to heart as they may be fake, instead focus on the negative ones
  • Take notice of the app's permissions and terms and conditions
  • Use high-quality mobile security
  • Be sure to check that the app's name and the developer's name match the official app details. Many fake versions can trick users, particularly if there is high anticipation for the app's launch
Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.