Skip to main content

500,000 people downloaded QR code apps with embedded malware from Google Play

Android malware seems to be everywhere. Every few weeks, we hear of a new set of apps on the Google Play Store that have some kind of malware embedded in them, and this time around it seems like a series of QR code readers may be targeting unknowing users.

The news comes in a report from SophosLabs, and it notes that as many as seven QR code readers on the Google Play Store may have been infected with malware. In addition to the QR code apps, one smart compass may have also been infected.

Recommended Videos

The malware itself is called Andr/HiddnAd-AJ, and as the name suggests, it basically plays ads on your phone — after lying low for a while to “lull you into a false sense of security.” The malware waits six hours before it springs into action and starts serving up full-screen ads and opening ads on webpages. The malware also sends users notifications with links to ads.

Please enable Javascript to view this content

According to Sophos, the malicious apps were downloaded as many as 500,000 times before Google removed them from the Google Play Store, and they were able to make it through Google’s scanning by essentially hiding the hostile code in what looked to be regular Android app code. At least on the surface, the apps did what they advertised they could do. The QR code readers could still read QR codes, and if you downloaded the apps for one use, only to delete them afterwards, you likely never would have run into the ads that the apps serve up. That, plus the fact that the malicious code didn’t kick into gear until 6 hours after installation, helped the apps avoid detection.

Of course, it’s likely the incident will help Google refine its malware scanning process — so it’s entirely possible that we won’t see apps similar to this again. It’s also still recommended that you continue using Google Play, if possible. While incidents like this do happen every now and again, the fact is that downloading apps from Google is far safer than downloading them from third-party marketplaces.

“Many off-market Android app repositories have no checks at all – they’re open to anyone, which can be handy if you’re looking for unusual or highly specialized apps that wouldn’t make it onto Google Play (or trying to publish unconventional content),” said Sophos in its blog post.

Christian de Looper
Christian de Looper is a long-time freelance writer who has covered every facet of the consumer tech and electric vehicle…
Google Play improves privacy, payments, and subscriptions 
Person holding Samsung Galaxy smartphone showing Google Play Store.

Google is introducing several new features that will help game and app developers to engage and grow their audience while further improving privacy and security.

At this year’s Google I/O conference, the Google Play team is focusing on new initiatives to create an even safer app ecosystem for users and developers alike while also adding new tools for developers. These include new custom store listing options, increased flexibility in pricing models for in-app subscriptions, and more. The Google Play team outlined these new initiatives during its What’s New in Google Play session at Google I/O 2022.

Read more
Google faces lawsuit over controversial Play Store change
Google Play Store on the OnePlus Nord 2.

Google has started requiring all Android apps sold in the Play Store that use in-app payments to use Google's Play Store billing system and nothing else -- or leave the store. This hasn't gone down well with the Match Group, creator of dating services including Tinder and the eponymous Match. The company is now suing Google over monopolistic and anti-competitive actions, alleging irreparable harm to Match's business and calling the move to remove its app a "death knell threat" to their business.

Google had previously allowed Match's apps, including Tinder, to opt out of using the Play Store's billing system, but the company has changed its mind in recent months. Rather, it will be requiring all apps in the Play Store which support in-app Payments to use Google's Play billing system without the option of a third-party payments processor. This will exclude apps that sell physical goods like Uber Eats and Amazon, but ensnare those which sell digital goods like Amazon's Audible and Kindle apps. For Match, which had previously been allowed to run its own payment system side-by-side with Google's, the move comes as a slap in the face.

Read more
Google Play Store helps find the apps invading your privacy
Instagram app on the Google Play Store on an Android smartphone.

Google has implemented a feature that requires app makers to disclose what data their apps are taking from users. Starting today, Android users will be able to see specific information about their apps' data collection through the Google Play Store. The data is accessible in the Play Store via the "Data Safety" tab listed in the information section for all apps.

With Google's announcement that the feature's rollout is live, the company notes that not all apps will be showing what privacy data they collect immediately. App makers have until July 20, 2022, to provide the Play Store with privacy information, making the feature something of a gradual rollout. It's likely that apps that take more types of data (like social media apps) will take longer to post the required info due to the sheer number of data points they collect when compared to something simpler such as an offline game.

Read more