A new malware strain capable of starting on its own after users download one of the affected apps has been discovered on the Google Play Store by research from the cybersecurity firm McAfee. Unlike other malicious apps that need to be opened first, apps that contain the HiddenAds malware begin running malicious services automatically after being installed. They also continuously show advertisements on a victim’s Android smartphone and are quite difficult to remove once installed. According to a blog post (opens in new tab) from McAfee’s Mobile Research Team, most of the apps containing this new malware are disguised as cleaner apps that delete junk files or help optimize battery life on Android devices.
Delete these apps immediately
Below you’ll find a list of all 13 apps which contain the HiddenAds malware along with the number of times they’ve been downloaded from the Play Store:
Junk Cleaner - 1M+EasyCleaner - 100K+Power Doctor - 500K+Super Clean - 500K+Full Clean -Clean Cache - 1M+Fingertip Cleaner - 500K+Quick Cleaner - 1M+Keep Clean - 1M+Windy Clean - 500K+Carpet Clean - 100K+Cool Clean - 500K+Strong Clean - 500K+Meteor Clean - 100K+
Auto-starting malware capable of hiding itself
Despite the fact that they contain malware, all of these apps managed to slip past Google’s defenses and end up on the Play Store. Fortunately, though, McAfee shared its findings with the search giant and they have all since been removed. However, you will need to manually delete them from your Android smartphone. Although downloading and installing an app without opening it is normally safe, that isn’t true in this case. When you install any of these apps on your devices, they automatically launch the HiddenAds malware and begin operating in the background. At the same time, these malicious apps are capable of hiding themselves to prevent users from noticing and deleting them. For instance, they change their icon to a Google play icon users are familiar with and change their name to either ‘Google Play’ or ‘Setting’ to remain undetected. The malicious services run by these apps display advertisements to victims in a number of ways. However, all of these ads are full screen and very intrusive. HiddenAds malware apps also try to get users to run an app when they install, uninstall or update any of the other apps on their devices.
Advertising on Facebook
To promote their new malware, the cybercriminals behind the HiddenAds campaign actually turned to Facebook to do so. Since all of these apps slipped past Google’s defenses and ended up on the Play Store, their creators were able to make Facebook pages for each app and promote them on the social network. This is because Facebook doesn’t see Play Store URLs as malicious even if these links lead to apps containing malware. Cybercriminals often take advantage of free services to attract victims to their malware and anyone can create their own Facebook Business account and business page.
How to protect yourself from the HiddenAds malware
The first thing you should do is check the list above and make sure none of these apps are installed on your smartphone or Android tablet. From here, you should uninstall them and consider using one of the best Android antivirus apps on your phone to remove any malware they may have left behind. You should also ensure that Google Play Protect is enabled on your devices as it constantly scans the apps installed on your smartphone for malware and warns you if you’re about to install a suspicious app. While you shouldn’t install apps from unknown sources, malware can and often does, end up on the Play Store despite Google’s best efforts. This is why you should stick to apps from well-known brands with good reviews and high install counts. If an app comes from an unknown developer, it could be fine though it might be malicious. As the HiddenAds malware is still being developed and the cybercriminals behind it are developing new variants, we could see more malicious apps using it in the future according to McAfee. Next: This new Chrome malware spies on your Gmail. Protect yourself now.
