These 280 Android apps could steal your money!

Currently, Android is a fairly secure OS, even being able to detect and warn about potential malware-infected apps. However, cybercriminals are not giving up and are trying to bypass traditional security methods. A recent investigation found 280 Android apps infected with malware to steal your funds, especially if you handle cryptocurrencies.

At least 280 malware-infected Android apps that look official are available outside the Play Store

The cryptocurrency sector has always been an attractive target for malicious actors. Hackers have managed to breach even big-money exchanges, so they could do it with individual users as well. McAfee’s Mobile Research Team found hundreds of Android apps that might make you think twice about downloading apps outside of the Play Store.

The report claims that the 280 Android malware-infected apps have a legitimate appearance. However, the Play Store’s security systems would still be able to detect and remove them (or simply reject their upload to the platform). So, attackers distribute it through other means, such as text messages and social media. Hackers also deploy social engineering methods to try to convince the user that the infected app is trustworthy or comes from official sources.

The malicious links redirect the user to download an APK file and encourage them to install it. The app then requests sensitive permissions such as access to contacts, SMS, and device storage. They even offer instructions to disable battery-saving settings on the app, which will allow it to always be active in the background.

The apps target cryptocurrency wallet users

The storage access permission is the most important. The app’s main goal is to retrieve the images stored on the phone and send them to the attacker. Then, a software tool analyzes whether there is a mnemonic recovery phrase or seed word among those images. If you aren’t aware, cryptocurrency wallet users need these keys to access their funds, especially if they have self-custody cold wallets.

Cold wallets don’t require personal data like email or name to use them. In fact, they work offline, so you need to be especially careful with your recovery phrase. Even the wallet developer can’t help you regain access if you lose it. This leads to people taking screenshots of the recovery phrase so they never forget it. Attackers designed the 280 Android malware apps with this behavior in mind.

Additionally, the infected apps can turn your phone into a malware distribution center. That’s why they previously requested permissions to access both your contacts and your text messages. They’re even able to capture data from incoming text messages, like some banking apps do.

Android’s security layers and common sense should be enough to keep you safe

Falling for a similar attack isn’t that easy, though. It requires you to voluntarily bypass multiple layers of security on Android beforehand. For example, many browsers (like Chrome) warn you about APK downloads before you start them. It’s even possible that Play Services analysis will throw up a warning. Additionally, you must voluntarily grant all permissions required by the app. You should never do this last thing, especially with apps outside of the Play Store.