Skip to main content

Android malware keeps returning even after factory reset through Google Play

Cybersecurity firm Malwarebytes revealed a form of Android malware that keeps returning even after performing a factory reset on a smartphone.

Malwarebytes discovered the Android trojan named the xHelper in May 2019. The malware is capable of installing itself on an Android device without notifying the owner, then receives remote commands and downloads additional malware into the infected smartphone or tablet.

Unfortunately, it appears that xHelper is still evolving. Amelia, an Android device owner, reached out to the Malwarebytes support forum to seek help for a curious case.

Amelia was able to remove two variants of xHelper and a trojan agent from her Android device through Malwarebytes’ app. However, xHelper kept coming back less than an hour after it was removed, even after Amelia performed a factory reset on her phone.

In Malwarebytes’ investigation, the first suspect for the returning xHelper was pre-installed malware, which was a possibility because Amelia’s phone was made by an unnamed, lesser-known manufacturer. However, after Amelia was guided through the process of checking if this was the case, xHelper did not go away.

Malwarebytes then noticed that the source of installation for xHelper was Google Play. When the service was deactivated, the re-infections of the malware stopped.

The firm determined that Google Play itself was not infected with malware, but it was triggering the re-installation of xHelper. They then discovered an Android application package hidden inside the phone’s files that serves as a trojan dropper. Directories and files, including the APK, remain on an Android device even after a factory reset, unlike apps, which is how xHelper keeps infecting the phone. The method for installing the APK through something triggered by Google Play, however, is still under investigation.

Malwarebytes, which detailed a step-by-step guide for removing xHelper malware, tagged Amelia’s case as a “new era in mobile malware,” as a factory reset is usually the last, but effective, option in cleaning an infected device. Fortunately, Amelia “was as persistent as xHelper itself” in searching for the truth behind the case.

Hackers are continuously evolving, taking advantage of technology and current events for their attacks. As always, people should remain vigilant against cybersecurity threats and are recommended to reach out to experts for any suspected security risks.

Editors' Recommendations

Aaron Mamiit
Aaron received a NES and a copy of Super Mario Bros. for Christmas when he was 4 years old, and he has been fascinated with…
Stalking apps: Google deletes 7 Android trackers from the Play Store
how to send money on facebook smartphone friends internet connection

While there are already a bunch of legitimate apps and services that can let you know the whereabouts of family or friends, there are also a few sinister variations that let abusive types spy on partners, among others.

Antivirus firm Avast revealed on Wednesday that its researchers recently uncovered seven so-called “stalkerware” apps on the Google Play Store, all of which have now been removed by the web giant.

Read more
Google Play Store feature suggests unused apps to uninstall from Android phones
Google Play store on a smartphone in someone's hand.

A new Google Play Store feature is suggesting a list of unused apps that people may want to uninstall from their Android devices to free up some space.

Downloading and installing apps to Android smartphones through the Google Play Store is easy, so it is understandable if people accumulate apps that they do not regularly use.

Read more
Google could soon deliver system updates through the Play store
Google play

It looks like Google could be working on a way to change how system updates are delivered to Android phones. While users have long had to head into the Settings app to check for system updates, code discovered by 9to5Google suggests that Google could soon deliver updates to Android phones through the Google Play store.

If Google ends up making the change to how Android updates are pushed, it would likely look similar to how updates are currently delivered -- just in Google Play instead. The code notes that there's a download button, an interface highlighting that the update is "Installing" and a message saying "All good! Update complete" when the update has finished installing.

Read more