Skip to main content

These fake Android apps steal your money when you aren’t looking

If you thought you were immune from hackers when downloading “legit” Android apps from Google Play, then think again. The McAfee Mobile Research team recently discovered a new campaign where at least 15 apps were “re-packaged” to secretly sign up for premium paid services in the background. The list includes Qrcode Scanner, Cut Ringtones 2018, and Despacito Ringtone.

The campaign is run by the AsiaHitGroup Gang who first appeared in late 2016 to target victims primarily in Thailand and Malaysia. The group used a fake app installer called “Sonvpay.A” that, for a price, pretended to install popular apps delivered outside Google Play. But it secretly subscribed at least 20,000 victims to paid services in the background by sending SMS messages to premium-rate numbers.

But that was only the beginning.

The group then moved on to bigger bucks through Google Play during November 2017 in its second campaign targeting Thailand, Malaysia and Russia. They modified the fake installer, now called “Sonvpay.B,” to serve as full-fledged familiar-but-fake apps listed on Google’s storefront. For this campaign, Sonvpay relied on IP address geolocation to identify the victims’ country of origin. The campaign also used the same SMS method while adding WAP billing — aka direct billing to a mobile carrier — to secretly subscribe victims to premium services. 

The group’s third campaign began in January 2018 targeting devices accessing Google Play in Malaysia and Kazakhstan. Instead of creating fake apps, the group bundled legitimate Android apps with “Sonvpay.C,” which uses silent background push notifications to secretly subscribe victims to premium paid services. The apps themselves don’t pose any kind of threat outside wanting permission to access SMS messages. In fact, they act completely normal. 

“The subscription operates primarily via WAP billing, which does not require sending SMS messages to premium-rate numbers,” McAfee’s Carlos Castillo reports. “Instead it requires only that users employ the mobile network to access a specific website and automatically click on a button to initiate the subscription process.” 

After you install one of these apps, the Sonvpay component receives commands to sign onto premium paid services through push notifications that the device owner never sees. These services are billed directly to the mobile carrier. Even more, there’s a fake “update” component where if the device owner agrees to the update, Sonvpay.C will subscribe to premium services. Even if the user doesn’t agree, the services may show up on the mobile carrier’s bill anyway depending on the command sent through the push notification. 

The problem with carrier billing and this type of fraudulent charge is that it’s typically not discovered until the victim receives a monthly statement. These charges are typically subscription-based as well, so victims must figure out how to unsubscribe from the premium service.

When McAfee’s team discovered Qrcode Scanner, Cut Ringtone 2018 and Despacito Ringtone loaded with the Sonvpay.C component, they promptly alerted Google and saw the apps disappear from Google Play. Despacito for Ringtone appeared several days later, once again laced with Sonvpay.C, but was quickly nuked by Google.

Unfortunately, the AsiaHitGroup Gang will likely return for a fourth campaign. 

Editors' Recommendations

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
This Dell XPS 13 laptop is down to its clearance price
Dell XPS 13 2024 front view showing display and keyboard.

We’re always on the lookout for laptop deals, and we just found one that we think most folks are going to dig! For a limited time, Dell has marked down the Dell XPS 13 Laptop to $700. Officially on clearance, you can now save $300 on this awesome Windows PC while supplies last. 

Why you should buy the Dell XPS 13 laptop
We see numerous Dell laptop deals in our daily promo combing, but this one stopped us in our tracks. The XPS 13 is meant to go toe to toe with one of the fiercest laptop foes in the biz — the MacBook Pro. And guess what? This PC does a solid job of giving Apple’s tried and true fan-favorite a run for its money. 

Read more
Walmart just discounted this HP laptop from $519 to $279
The HP 14-inch laptop on a small desk with some headphones.

Alert the press! Sound the alarm! The HP 14-inch Laptop received a massive markdown from Walmart. While this promotion lasts, you’ll be able to purchase this budget-friendly laptop for just $280. That’s $240 off the normal selling price! Student laptop deals usually kick into full swing toward the end of August, but this is a great opportunity to nab a powerful PC before the back-to-school rush. 

Why you should buy the HP 14 Laptop
We love all HP laptop deals, but this one’s particularly good. The HP 14-inch N305 is powered by an 13th-gen Intel Core i3-N305 CPU, Intel UHD Graphics, and 8GB of DDR4 RAM. It’s not the most powerful laptop in the world, but you’ll have no issue multi-tasking with desktop apps or running one of your favorite PC games. 

Read more
The best password managers for 2024
have i been pwned owner uncovers 13 million plaintext passwords leaked from free webhost is a safe password even possible we

If you're thinking about getting a new password manager, we can help narrow down your choices. Here's a list of the best and most secure solutions for taking your logins with you wherever you go, no matter what device you use.
No more retyping passwords every time you switch from your Windows PC to your iPhone or from a Mac to an Android phone. These premium password managers have more than just the basics, making your life easier and keeping your accounts safe at affordable prices.

1Password (Windows, Mac, iOS, Android, Linux, and Chrome OS)

Read more