Trojan Hidden in Android Games Installed on Over 9M Devices
Mobile security researchers discovered that innocent-looking Android games actually contain malware in them. The applications in question have already been installed on over 9.3 million devices running Google's mobile OS.
The names of the malware-laden games are difficult to distinguish from the regular fare of bulk-produced, relatively low-effort time-waster games on the Android platform. Titles such as "Cat cute diary" or "City Luxury Car Racing" would not make anyone think of Trojans and data theft, but this is exactly what installing one of them and running it on your device leads to.
The applications are distributed through the Huawei AppGallery - the Chinese phone maker's analog to the official Android Google Play Store.
The Trojan found inside the innocently titled games of various genres is tracked by researchers as Android.Cynos.7.origin. Looking into its insides shows that it is primarily used for scraping phone numbers and mobile device information and then probably reselling the exfiltrated data and bombarding the device with advertisements.
The malicious games containing the Trojan target all sorts of demographics, with some games bearing titles in Russian, some in Chinese and some, targeting international audiences, titled in English.
For anyone who is relatively security-savvy, especially when it comes to mobile devices, the fact that the games ask for permissions such as "making and managing phone calls" or requesting location data access should be a massive red flag.
Once the user grants permission, the Trojan contained inside the malicious game apps gets access to the device's number, GPS location, specs of the device. A few tweaked versions of the same base Trojan malware also resort to more extreme malicious activities, including sending SMS messages to premium paid services, intercepting incoming SMS messages, and downloading and installing additional apps without the user's explicit permission and knowledge.
Huawei has already been notified about the presence of those malicious applications on their AppGallery and has promptly removed them, but the damage to those 9M+ devices has already been done.
