Security company Lookout is warning Android device owners about a new type of malware app, which not only secretly roots your phone, but also installs itself as a system application — making it extremely difficult to remove. How difficult? If you’re not technically inclined enough to entirely replace the ROM, then a brand-new phone may be the easiest way to escape its clutches.
Lookout refers to the virus as trojanized adware, and it’s hiding inside apps that appear to be legitimate versions of very popular apps, including Facebook, Twitter, Candy Crush, NYTimes, Google Now, Snapchat, and WhatsApp. The company has even seen compromised versions of two-step authentication app Okta.
However, before you start desperately trying to uninstall those apps from your phone, the malware-infected versions aren’t the originals, and have only been discovered in third-party app stores, not Google Play. If you’ve only been playing inside Google’s store, then you should be fine.
The infected apps are very clever. Lookout has detected 20,000 examples, and most work in exactly the same way as the apps they copy, making it more difficult for you to detect and therefore, less likely to try and uninstall it. With root access to your phone, the app becomes ingrained in the OS, which is how it becomes almost impossible to delete. Once up and running, ads will be pushed to your phone, and worse, apps can be downloaded and installed without your consent. Why? Because delivering ads and installing apps make the attackers money.
Apps infected with the trojans — known as Shuanet, Kemoge/ShiftyBug, and Shedun/GhostPush — have been discovered in many parts of the world, with the U.S, Germany, Iran, Russia, India, Jamaica, Sudan, Brazil, Mexico, and Indonesia being the worst hit, according to the report. Lookout warns this type of adware attack will only get more sophisticated, and make better use of root access to a phone, over time.
If you’ve been downloading apps from Android app stores other than Google Play (Amazon is probably safe too), and are worried you may have fallen victim to the trojanized adware, there’s a sure way to find out. Remember, the infected apps almost certainly cannot be uninstalled. If you can drag and uninstall the app, chances are it’s fine. Lookout doesn’t provide a complete list of apps that have been targeted by the malware, but does say it’s popular “first-tier” apps that are repackaged and sent out.
