THOUSANDS of Android owners have been urged by cybersecurity experts to check their phones for two malicious decoy apps.
The apps are designed to inject devices with a banking trojan that can steal victims’ details and loot their bank accounts.
The trojan, known as Anatsa or Teabot, has been spotted targeting employees and customers of financial institutions across Europe, the UK, the US and Asia by experts at cloud security company Zscaler.
However, the nature of the two decoy apps means that nearly anyone could have downloaded them.
The apps are called ‘PDF Reader & File Manager’ and ‘QR Reader & File Manager’.
Alone, the pair have been downloaded roughly 70,000 times.
Mini explainer: What is a trojan app?
There are lots of different types of malicious scam apps to be wary of.
You can get phishing, ransomware, spyware, spam and rooting apps, all designed for varying types of trickery and criminal activity.
Trojan apps, according to separate experts at anti-virus firm Kaspersky, look like innocent apps – but they are actually hiding something more sinister.
Its namesake is the Trojan Horse, an ancient tale of wooden horse wheeled into the walled city of Troy as a gift, with a secret army of Greek warriors silently waiting inside.
“Trojan apps are those that seem harmless, such as a simple game, but secretly perform undesirable actions in the background,” Kaspersky’s experts explained.
“They include a benign component that allows the app to function as intended and a hidden harmful component, such as sending premium SMS messages from your device without your knowledge.”
Android owners must be on high alert, say Zscaler’s cybersecurity experts, after they found more than 90 other malicious apps on the Google Play Store.
Experts have not named these other apps, which also harbour the banking trojan.
But they have been downloaded over 5.5million times.
While Google is generally good at spotting and removing malicious apps before they land on the Play Store, some slip through the cracks.
Most read in Phones & Gadgets
App scammers are increasingly employing a new, and more advanced tactics to avoid detection.
How to spot a dodgy app
Detecting a malicious app before you hit the ‘Download’ button is easy when you know the signs.
Follow this eight-point checklist when you’re downloading an app you’re unsure about:
- Check the reviews – be wary of both complaints and uniformly positive reviews by fake accounts.
- Look out for grammar mistakes – legitimate app developers won’t have typos or errors in their app descriptions.
- Check the number of downloads – avoid apps with only several thousand downloads, as it could be fake.
- Research the developer – do they have a good reputation? Or, are totally fake?
- Check the release date – a recent release date paired with a high number of downloads is usually bad news.
- Review the permission agreement – this agreement gives permission for the app to take bits of your data, and fake apps often ask for additional data that is not necessary.
- Check the update frequency – an app that is updated too frequently is usually indicative of security vulnerabilities.
- Check the icon – look closely, and don’t be deceived by distorted, lower-quality versions the icons from legitimate apps.
All of this information will available in both Apple’s App Store and the Google Play Store.
