25million Android phones Affected with Malware That Hides on Whatsapp- Is Yours Affected?

Researchers has discovered a malware that affected 25million Android smartphones, these apps replaces WhatsApp and other android apps with malicious versions that serves and pop ups ads automatically on the user’s smart phone, plus other damages

As indicated by the security analysts from Check Point, the malware which has been named ‘Agent Smith’ camouflages itself as a Google-related application and after that replaces applications installed on the users phone with pernicious adaptations of them through unknown Android vulnerabilities without the users permission.

“Disguised as a Google-related application, the malware exploits known android vulnerabilities and automatically replaces installed apps with malicious versions without user’s knowledge or interaction,” Check Point said.

Check Point said that the Agent Smith malware utilizes its entrance to Android gadget to show counterfeit promotions for monetary profit. Nonetheless, its entrance on Android clients phone implies it could be utilized for progressively evil purposes, however it isn’t clear whether the malware have been going that course.

Due to its ability to hide its icon from the launcher and impersonate any popular existing apps on a device, there are endless possibilities for this sort of malware to harm a user’s device,” the security researchers noted.

The threat knowledge firm said the malware, Agent Smith started on a prominent outsider applications store called 9Apps (possessed by China’s Alibaba) and not the official Google Play Store. The malware appear to target chiefly Arabic, Hindi, Indonesian, and Russian speakers.

Be that as it may, larger part of the malware’s exploited people are in India, Bangladesh, Pakistan, Australia, UK, US, Pakistan, Saudi Arabia, Myanmar, Indonesia, and so on

These are the 10 top countries that seems to have suffered the more from the malware:

Indian 15.2 million,
Bangladesh 2.5 million,
Pakistan 1.6 million,
Indonesia 572K
Nepal 469K
US 302K
Nigeria 287K
Hungary 282K
Saudi Arabia 245K

This is how the malware gets to uses device.

The Android user goes to 9App store and unsuspectingly download an app – it could be a game, photo utility or an adult theme app which might happen to be one of the infected apps: Phone Projector, Rabbit Temple, Kiss Game: Touch Her Heart, Girl Cloth XRay Scan Simulator, or Flash – Call Screen Theme.

Now, the infected app will then silently install the malware which disguises as a legitimate Google updating tool.

To avoid creating suspicion from the Android user, the newly installed malware won’t leave any icon on the screen.

As soon as the background installation is done, legitimate apps such as WhatsApp, Opera browser, TrueCaller, etc. will then be replaced with malicious versions via an update.

Reports fine Check Point has it that the hackers behind this are intending moving to Google Play Store. The security researchers said that they’ve found about 11 apps on the Google Play Store that contained “dormant” piece of the hackers software. Google in turn took no time in taking down the apps,

These apps includes:

Blockman Go: Free Realms & Mini Games by Blockman Go Studio, Cooking Witch by Ghost Rabbit, Ludo Master – New Game 2019 For Free by Hippo Lab, Angry Virus by A-Little Game, Bio Blast – Infinity Battle: Shoot virus! Taplegend, Shooting Jet by Gaming Hippo, Gun Hero: Gunman Game for Free by Simplefreegames, Clash of Virus by BrainyCoolGuy, Star Range by A-little Game, Crazy Juicer – Hot Knife Hit Game & Juice Blast by Mint Games Global, and Sky Warriors: General Attack.

How To Know if Yours Smartphone is Affected and Stay Save

If you have been seeing unnecessarily ads pop up on your Android smartphone, then there is a possibility that this malware exists on your device, here is how to check and remove it:

1. Go to Settings on your Android device
2. Locate the Apps and Notification section and then head to the app info list.

3. From the app info, search for any of the above listed apps and also for suspicious applications with names like:
Google Updater, Google Installer for U, Google Powers and Google Installer
Next, click on the suspicious app and then uninstall it.

To stay safe from such attacks, every Android user is advised to always stick to the official Play Store by Google. Though the Play Store also has it own flaws, its still way ahead of other other third -party Android store in the wild. and to always scan apps with Google protect before installation.

Do well to inform others, by sharing this posts via any of the share buttons below.