New Android Virus Hidden In Apps Can Empty Banking Wallets; Uninstall These Apps ASAP

KEY POINTS

The virus has been victimizing users for over two years
Dubbed GriftHorse Android Trojan, it is found hidden in various apps
Unsuspecting users were tricked into subscribing to a recurring payment

Android users beware! A new trojan that hides in various apps available on Google Play can steal your money using sophisticated techniques.

What is the GriftHorse Android Trojan?

Cybersecurity firm Zimperium claimed the dreadful virus, identified as the GriftHorse Android Trojan, has so far infected 10 million active Android devices. The malicious software has been spotted in over 200 apps in at least 70 different countries.

The sad truth is that the GriftHorse Android Trojan has been infecting and taking advantage of Android users since November 2019. But how does it victimize unsuspecting users?

The trojan tricks people into subscribing to a recurring payment, which if left unchecked, could not only steal money but also empty banking wallets and apps. Google has confirmed the infected apps have been removed from the Play Store but it is not known if third-party platforms have done the same.

Unfortunately, even if the apps have been removed from the Play Store, the virus can still infect the devices of users who have already downloaded them.

"These malicious Android applications appear harmless when looking at the store description and requested permissions, but this false sense of confidence changes when users get charged month over month for the premium service they get subscribed to without their knowledge and consent," Zimperium revealed Wednesday.

"Upon infection, the victim is bombarded with alerts on the screen letting them know they had won a prize and needed to claim it immediately. These pop-ups reappear no less than five times per hour until the application user successfully accepts the offer," the cybersecurity firm disclosed.

After accepting the invitation, "the malware redirects the victim to a geo-specific webpage where they are asked to submit their phone numbers for verification. But in reality, they are submitting their phone number to a premium SMS service that would start charging their phone bill over €30 ($34.74) per month," the blog post further revealed.

People will not notice the impact of the theft immediately and sometimes, it will go on for months before being detected.

The malware is hidden in a wide spectrum of benign-looking apps that pester user with notifications for various promotions.

If the user visits these links, they are asked to verify their phone number, but in reality they're subscribing themselves to premium SMS services. pic.twitter.com/A3DZ6e3K9D
— Catalin Cimpanu (@campuscodi) September 29, 2021