Malicious antivirus apps prey on ransomware fears
Recent weeks have seen a rise in fake WannaCry protectors on mobile app stores, even though this particular infection doesn't target mobile devices.
But using the fear of high profile infections to get users to download potentially unwanted programs or malware is nothing new according to threat management company RiskIQ. Using its mobile database, hundreds of examples of apps that claim to help defend mobile phones were found, instead, to be preying on unsuspecting users by pushing adware, trojans, and other malware.
Using a title search for 'antivirus' resulted in 6,295 total apps, past and present, claiming to either be an antivirus solution, review antivirus solutions or be associated with antivirus software in some way. More than 700 of these apps triggered blacklist detections from the aggregated antivirus vendors in VirusTotal. Trimming the dataset to compare apps only coming from the Google Play store showed 655 results. Of those, 131 had triggered blacklist detections.
Looking only at antivirus apps still labeled as active, there are 4,290 and 525 have blacklist hits. The Google Play store has 508, with 55 blacklisted. Comparing the numbers, it shows that historically, the Google Play store has had a greater percentage of blacklisted antivirus apps, at 20 percent versus the overall 11 percent. However, the current level of blacklisted antivirus apps in the Google Play store is at 10.8 percent, versus the overall of 12.2 percent.
To keep your mobile device safe, RiskIQ recommends only downloading from official stores, reviewing the permissions requested, and making sure the developer email address is not a free email service like Gmail or Hotmail. It also suggests looking over the app description to see if it's riddled with grammatical errors. And where possible, checking the app against known blacklists, VirusTotal provides an excellent starting point.
You can find out more about the findings on the RiskIQ blog.
Photo Credit: andriano.cz/Shutterstock