Although the Google Play Store is the official way to download applications and has many levels of security protection, it is still difficult to stop all malicious people from speculating. Research has found more than 300 malicious Android apps in the Google Play Store that have been downloaded 60 million times and act as adware or attempt to steal credentials and credit card information.
Research finds malicious ‘Vapor’ app on Google Play Store that has been downloaded 60 million times
IAS Security Threat Research CenterIt first discovered this malicious activity, classified it as “Vapor”, and stated that this malicious activity has been ongoing since early 2024. LAS identified 180 apps as part of the Vapor campaign, which generates 200 million fraudulent ads every day, forming part of a massive ad scam.
A new report from BitdefenderBringing the number of malicious apps to 331, the report states that they span Brazil, the United States, Mexico, Türkiye and South Korea. Bitdefender warns that these apps display ads out of context and even try to convince victims to reveal credentials and credit card information in phishing attacks. Although all of these apps have been removed from the Google Play Store, the risk of Vapor resurgence via new apps is high as threat actors have demonstrated the ability to circumvent Google’s review process.
Apps included in the Vapor campaign include health and fitness tracking, note-taking tools and journals, battery optimizers and QR Code scanners, among other professional-featured utilities. These apps passed Google’s security review because they contained promoted functionality and did not contain malicious components when submitted for review, which were then downloaded to the user’s device through updates provided by the command and control server (C2) after the user installed them.
Some of the larger noteworthy cases highlighted by Bitdefender and IAS are below, you can also go toSee all 331 Vapor app listings：
- AquaTracker – 1 million downloads
- ClickSave Downloader – 1 million downloads
- Scan Hawk – 1 million downloads
- Water Time Tracker – 1 million downloads
- Be More – 1 million downloads
- BeatWatch – 500,000 downloads
- TranslateScan – 100,000 downloads
- Handset Locator – 50,000 downloads
Most Vapor apps will be available on the Google Play Store between October 2024 and January 2025, and continue until March.
The Bitdefender report also says that some apps go beyond ad fraud, displaying fake login screens for Facebook and YouTube, stealing credentials or prompting users to enter credit card information under various pretexts. If you find any of these apps installed, delete them immediately and run a full system scan using Google Play Protect (or other mobile antivirus software).
Source: KOCPC Chinese