Skip to main content

These fake Android apps steal your money when you aren’t looking

If you thought you were immune from hackers when downloading “legit” Android apps from Google Play, then think again. The McAfee Mobile Research team recently discovered a new campaign where at least 15 apps were “re-packaged” to secretly sign up for premium paid services in the background. The list includes Qrcode Scanner, Cut Ringtones 2018, and Despacito Ringtone.

The campaign is run by the AsiaHitGroup Gang who first appeared in late 2016 to target victims primarily in Thailand and Malaysia. The group used a fake app installer called “Sonvpay.A” that, for a price, pretended to install popular apps delivered outside Google Play. But it secretly subscribed at least 20,000 victims to paid services in the background by sending SMS messages to premium-rate numbers.

But that was only the beginning.

The group then moved on to bigger bucks through Google Play during November 2017 in its second campaign targeting Thailand, Malaysia and Russia. They modified the fake installer, now called “Sonvpay.B,” to serve as full-fledged familiar-but-fake apps listed on Google’s storefront. For this campaign, Sonvpay relied on IP address geolocation to identify the victims’ country of origin. The campaign also used the same SMS method while adding WAP billing — aka direct billing to a mobile carrier — to secretly subscribe victims to premium services. 

The group’s third campaign began in January 2018 targeting devices accessing Google Play in Malaysia and Kazakhstan. Instead of creating fake apps, the group bundled legitimate Android apps with “Sonvpay.C,” which uses silent background push notifications to secretly subscribe victims to premium paid services. The apps themselves don’t pose any kind of threat outside wanting permission to access SMS messages. In fact, they act completely normal. 

“The subscription operates primarily via WAP billing, which does not require sending SMS messages to premium-rate numbers,” McAfee’s Carlos Castillo reports. “Instead it requires only that users employ the mobile network to access a specific website and automatically click on a button to initiate the subscription process.” 

After you install one of these apps, the Sonvpay component receives commands to sign onto premium paid services through push notifications that the device owner never sees. These services are billed directly to the mobile carrier. Even more, there’s a fake “update” component where if the device owner agrees to the update, Sonvpay.C will subscribe to premium services. Even if the user doesn’t agree, the services may show up on the mobile carrier’s bill anyway depending on the command sent through the push notification. 

The problem with carrier billing and this type of fraudulent charge is that it’s typically not discovered until the victim receives a monthly statement. These charges are typically subscription-based as well, so victims must figure out how to unsubscribe from the premium service.

When McAfee’s team discovered Qrcode Scanner, Cut Ringtone 2018 and Despacito Ringtone loaded with the Sonvpay.C component, they promptly alerted Google and saw the apps disappear from Google Play. Despacito for Ringtone appeared several days later, once again laced with Sonvpay.C, but was quickly nuked by Google.

Unfortunately, the AsiaHitGroup Gang will likely return for a fourth campaign. 

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
This pack of corn puffs hasn’t left my gaming PC — here’s why
A pack of Kuai Kuai sitting on a gaming PC.

In Taiwan, I fell in love. I didn't find a spouse, a pet, or suddenly decide to move my life to the other side of the world. I fell in love with a coconut-flavored corn puff called Kuai Kuai (or "Guai Guai"). And since returning home, I've had an unopened bag of the snack leaning on my gaming PC.

If you're one of the few that knows about Kuai Kuai, you already know what's up. For everyone else, you probably think I'm a little off my rocker. You might be onto something there, but Kuai Kuai has an entire culture around it that I learned about on my trip to Computex this year, and it's been a great way to bring a little piece of Taiwan home with me.

Read more
The new Surface Laptop beats the MacBook Air in every way but one
The Surface Laptop 7th Edition on a white table.

The Surface Laptop was always meant to be a proper MacBook Air competitor. It had the sleek design and branding to pull it off, but was always lacking in performance and battery life to compete.

With the move to Qualcomm's Snapdragon X chips and Copilot+, though, there was a renewed hope that the Surface Laptop 7th Edition could not only compete with the MacBook Air M3 -- but actually defeat it. To my own surprise, after spending some time with the device, I'm convinced it may be the best Surface device ever made.
Specs and configurations

Read more
Prime Day 2-in-1 laptop deals: Dell, HP and more
The Dell Inspiron 14 2-in-1 laptop against a white background.

One of the more versatile options when it comes to the best Prime Day laptop deals are 2-in-1 laptops, and you'll find quite a few to choose from among the Prime Day deals going on right now. Brands like Dell, HP, and Lenovo are seeing some of their most popular 2-in-1 laptops discounted for Prime Day, and we've got the beat on the best Prime Day 2-in-1 laptop deals to shop. You'll find below our choice for the best 2-in-1 laptop Prime Day deal, as well as some other options if it's not the right fit for you. Prime Day deals are coming and going quickly, so if you see a laptop deal that works for you be sure to grab it while you can.
Best 2-in-1 laptop Prime Day deal
Dell Inspiron 14 2-in-1 laptop -- $450, was $700

The Dell Inspiron 14 2-in-1 laptop is a relatively affordable option that offers the versatility of this type of device alongside reliable performance. It's equipped with the AMD Ryzen 5 7530U processor, integrated AMD Radeon Graphics, and 8GB of RAM, which will be more than enough for daily tasks that you need to get done for work or school. The Dell Inspiron 14 2-in-1 laptop also features a 14-inch touchscreen with Full HD+ resolution for sharp details and bright colors, and it's got Windows 11 Home pre-loaded in its 512GB SSD that should provide enough storage space for your important documents.

Read more