Trojan Hidden in Android Games Installed on Over 9M Devices

Mobile security researchers discovered that innocent-looking Android games actually contain malware in them. The applications in question have already been installed on over 9.3 million devices running Google's mobile OS.

The names of the malware-laden games are difficult to distinguish from the regular fare of bulk-produced, relatively low-effort time-waster games on the Android platform. Titles such as "Cat cute diary" or "City Luxury Car Racing" would not make anyone think of Trojans and data theft, but this is exactly what installing one of them and running it on your device leads to.

The applications are distributed through the Huawei AppGallery - the Chinese phone maker's analog to the official Android Google Play Store.

The Trojan found inside the innocently titled games of various genres is tracked by researchers as Android.Cynos.7. Looking into its insides shows that it is primarily used for scraping phone numbers and mobile device information and then probably reselling the exfiltrated data and bombarding the device with advertisements.

The malicious games containing the Trojan target all sorts of demographics, with some games bearing titles in Russian, some in Chinese and some, targeting international audiences, titled in English.

For anyone who is relatively security-savvy, especially when it comes to mobile devices, the fact that the games ask for permissions such as "making and managing phone calls" or requesting location data access should be a massive red flag.

Once the user grants permission, the Trojan contained inside the malicious game apps gets access to the device's number, GPS location, specs of the device. A few tweaked versions of the same base Trojan malware also resort to more extreme malicious activities, including sending SMS messages to premium paid services, intercepting incoming SMS messages, and downloading and installing additional apps without the user's explicit permission and knowledge.

Huawei has already been notified about the presence of those malicious applications on their AppGallery and has promptly removed them, but the damage to those 9M+ devices has already been done.

November 29, 2021

Cyclonis Backup

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.