Is your Android at risk? Thousands of users in Australia hit by malware apps
- Replies 8
In the ever-evolving world of technology, the threat of cybercrime is a constant concern.
Cybersecurity firm McAfee has uncovered a new malicious Android program, dubbed Xamalicious, that has infected over 340,000 devices worldwide, including a significant number in Australia.
This malicious software has infiltrated Android devices through apps available on Google Play, Android’s official mobile app store, and even some unofficial third-party app stores.
McAfee's investigation identified 14 infected apps on Google Play, three of which had at least 100,000 installs each.
Despite Google's swift action in removing these apps, users who installed them from mid-2020 until early-2023 are still at risk of active Xamalicious infections.
This necessitates manual scans and cleanup efforts to ensure the safety of their devices.
The most popular among the infected apps include Essential Horoscope for Android, 3D Skin Editor for PE Minecraft, and Logo Maker Pro.
Other affected apps include Auto Click Repeater, Count Easy Calorie Calculator, Dots: One Line Connector and Sound Volume Extender.
In addition to the apps found on Google Play, a separate set of 12 malicious apps that carried the Xamalicious threat has been identified on unofficial third-party app stores.
These apps infect users via downloadable APK (Android package) files, which anyone can directly download onto their phone and install programs from.
Unfortunately, specific download statistics for these apps are not available, making it difficult to gauge the full extent of the threat.
Furthermore, according to McAfee’s data, most infections have been reported in the United States, Germany, Australia, Spain, Brazil, Mexico, Argentina and the United Kingdom.
Xamalicious is an Android backdoor embedded within apps developed using the open-source Xamarin framework.
This makes code analysis more challenging, allowing it to slip past security measures undetected.
Once installed, Xamalicious requests access to the Accessibility Service of your phone, granting it the ability to perform privileged actions such as navigation gestures, hiding on-screen elements, and self-permission grants.
Xamalicious is capable of executing various commands, gathering device and hardware information, determining the device’s geographic location, identifying emulators, checking root status, listing installed apps, reporting accessibility service permissions and connecting to a remote server to download additional files.
McAfee has also uncovered links between Xamalicious and an ad-fraud app called Cash Magnet, which suggests that the backdoor may engage in ad fraud activities.
This also impacts your phone’s performance and network bandwidth.
Protecting Your Android Device
While Google Play implements measures to combat malware—including initiatives such as the App Defense Alliance—unfortunately, unofficial platforms lack such stringent controls.
This makes them a hotbed for malicious software.
Android users are strongly encouraged to refrain from downloading apps from third-party sources, to stick to essential apps, to read user reviews before installation and to thoroughly vet app developers and publishers.
Full package names for the infected apps can be found below:
If you have any of these apps installed on your device, it is recommended to uninstall them immediately and run a full system scan.
Have you experienced any issues with your Android device recently? Share your experiences and tips for staying safe online in the comments below.
Cybersecurity firm McAfee has uncovered a new malicious Android program, dubbed Xamalicious, that has infected over 340,000 devices worldwide, including a significant number in Australia.
This malicious software has infiltrated Android devices through apps available on Google Play, Android’s official mobile app store, and even some unofficial third-party app stores.
McAfee's investigation identified 14 infected apps on Google Play, three of which had at least 100,000 installs each.
McAfee identified 14 apps affected by the malware on Google Play. Image source: McAfee / Google Play.
Despite Google's swift action in removing these apps, users who installed them from mid-2020 until early-2023 are still at risk of active Xamalicious infections.
This necessitates manual scans and cleanup efforts to ensure the safety of their devices.
The most popular among the infected apps include Essential Horoscope for Android, 3D Skin Editor for PE Minecraft, and Logo Maker Pro.
Other affected apps include Auto Click Repeater, Count Easy Calorie Calculator, Dots: One Line Connector and Sound Volume Extender.
In addition to the apps found on Google Play, a separate set of 12 malicious apps that carried the Xamalicious threat has been identified on unofficial third-party app stores.
These apps infect users via downloadable APK (Android package) files, which anyone can directly download onto their phone and install programs from.
Unfortunately, specific download statistics for these apps are not available, making it difficult to gauge the full extent of the threat.
Furthermore, according to McAfee’s data, most infections have been reported in the United States, Germany, Australia, Spain, Brazil, Mexico, Argentina and the United Kingdom.
Xamalicious is an Android backdoor embedded within apps developed using the open-source Xamarin framework.
This makes code analysis more challenging, allowing it to slip past security measures undetected.
Once installed, Xamalicious requests access to the Accessibility Service of your phone, granting it the ability to perform privileged actions such as navigation gestures, hiding on-screen elements, and self-permission grants.
Xamalicious is capable of executing various commands, gathering device and hardware information, determining the device’s geographic location, identifying emulators, checking root status, listing installed apps, reporting accessibility service permissions and connecting to a remote server to download additional files.
McAfee has also uncovered links between Xamalicious and an ad-fraud app called Cash Magnet, which suggests that the backdoor may engage in ad fraud activities.
This also impacts your phone’s performance and network bandwidth.
Protecting Your Android Device
While Google Play implements measures to combat malware—including initiatives such as the App Defense Alliance—unfortunately, unofficial platforms lack such stringent controls.
This makes them a hotbed for malicious software.
Android users are strongly encouraged to refrain from downloading apps from third-party sources, to stick to essential apps, to read user reviews before installation and to thoroughly vet app developers and publishers.
Full package names for the infected apps can be found below:
If you have any of these apps installed on your device, it is recommended to uninstall them immediately and run a full system scan.
.png){kind=icon}
