11 Million Devices Infected with Botnet Malware Hosted in Google Play: A Detailed Overview



Introduction

Google Play, the trusted app store for Android devices, has faced multiple security breaches over the years. One of the most alarming is the infiltration of malware through legitimate apps. Recently, a new wave of malware, known as Necro, has emerged, affecting over 11 million devices. This article delves into how Necro infiltrated Google Play, the techniques it uses, and the consequences of its spread.

The Re-Emergence of Necro: A Familiar Threat

What is Necro Malware?

Necro is a notorious malware family known for its stealth and modular nature. First identified in 2019, Necro has evolved to become more sophisticated, with its latest version now using advanced methods like steganography (a technique that hides malicious data within seemingly harmless files) to infect devices. This malware is particularly dangerous because it can spread through legitimate apps available in Google Play, making it harder to detect and avoid.

Necro’s Infiltration of Google Play in 2019

In 2019, researchers discovered that a seemingly legitimate Android app on Google Play had been secretly infected with malware. This malware was embedded through a Software Development Kit (SDK) used by developers to generate advertising revenue. Once integrated into the app, the SDK allowed attackers to control infected devices, enabling them to download and execute hidden payloads. This caused millions of devices to be connected to attacker-controlled servers.

Necro's Return in 2024

Fast forward to 2024, and Necro is back, infecting over 11 million devices. This time, researchers from the security firm Kaspersky found that two popular apps—Wuta Camera and Max Browser—had been compromised. The malware was distributed through a malicious SDK, once again using legitimate apps as a vehicle for infection.

How Necro Malware Infects Devices

The Role of Malicious SDKs

Software Development Kits (SDKs) are essential tools for app developers, offering ready-made solutions for common tasks like displaying ads or managing user interactions. Unfortunately, these SDKs can be exploited, as was the case with Necro. The malicious SDK embedded in apps like Wuta Camera and Max Browser allowed attackers to remotely control infected devices. Once installed, the apps would communicate with attacker-controlled servers, downloading malicious code that could be executed at any time.

Stealthy Techniques: Steganography and Obfuscation

Necro uses sophisticated techniques to remain undetected. One of the standout methods is steganography, where malicious data is hidden within seemingly benign images. This method is rarely seen in mobile malware but was used by Necro to download additional payloads from attacker-controlled servers. By embedding malicious code within PNG images, the malware could evade detection by antivirus software.

The SDK module also employed obfuscation techniques, such as the use of the OLLVM tool, to hide its true purpose. Obfuscation makes the code more difficult to analyze, further complicating efforts to detect and remove the malware.

Command-and-Control Communication

Once the device is infected, it establishes communication with a command-and-control server. This server sends encrypted instructions to the infected device, which can include downloading additional payloads or executing specific tasks. The malware uses encrypted JSON data to transmit information about the compromised device, making it challenging for security researchers to trace and analyze its behavior.

The Impact of Necro Malware on Infected Devices

Adware and Subscription Fraud

One of the most immediate effects of Necro is the display of unwanted ads through invisible WebView windows. These ads are shown in the background, generating fraudulent revenue for the attackers without the user’s knowledge. Additionally, Necro can facilitate subscription fraud, where users are unknowingly signed up for paid services, racking up charges on their accounts.

Elevated System Privileges

Necro is designed to operate with elevated system privileges, giving it significant control over the infected device. This includes the ability to download and execute arbitrary code, modify system files, and bypass security measures. By exploiting vulnerabilities in Android’s WebView component, Necro can run malicious code with enhanced privileges, further increasing its ability to cause harm.

Infected Devices as Proxies for Malicious Traffic

Another concerning feature of Necro is its ability to turn infected devices into proxies for routing malicious traffic. This makes it harder for law enforcement and cybersecurity experts to trace the origin of attacks, as the malicious activity appears to come from legitimate devices scattered around the world.

Which Apps Were Infected?

Wuta Camera

One of the apps identified as being infected with Necro was Wuta Camera, a popular photo editing app with over 10 million downloads. The malicious SDK was embedded in versions 6.3.2.148 through 6.3.6.148. Although the app has since been updated to remove the malware, any device that installed these versions remains at risk of infection.

Max Browser

Another app compromised by Necro was Max Browser, a web browsing app with over 1 million downloads. Unlike Wuta Camera, Max Browser was removed from Google Play following Kaspersky’s report. However, users who had already downloaded the app remain vulnerable, as no clean version is available for upgrade.

Necro Beyond Google Play

Infection via Modified Versions of Popular Apps

While Google Play remains a significant distribution channel for Necro, the malware has also spread through modified versions of popular apps. These “mods” are often found on unofficial app stores and websites, promising enhanced features like ad-free Spotify or modified versions of WhatsApp with extended privacy settings. In reality, these modified apps often come bundled with Necro malware, infecting unsuspecting users who download them.

High-Risk Apps Identified

Some of the high-risk apps identified by researchers include:

  • GBWhatsApp and FMWhatsApp: Modified versions of WhatsApp with extended file-sharing limits and enhanced privacy features.
  • Spotify Plus: A modified version of Spotify that promises free, ad-free premium access.
  • Minecraft Mods: Mods for popular games like Minecraft, Stumble Guys, and Car Parking Multiplayer that are infected with Necro.

These apps are often distributed through unofficial websites, making it difficult to track the full extent of the infections.

How to Protect Your Device from Necro

Uninstall Infected Apps

If you have downloaded Wuta Camera or Max Browser, the first step is to uninstall the app immediately. This will prevent further malicious activity and stop the malware from spreading to other apps or devices.

Run a Security Scan

Next, run a security scan using a reputable antivirus app. Many antivirus programs can detect and remove Necro and its associated payloads, helping to clean your device of any lingering malware.

Enable Google Play Protect

Google Play Protect is a built-in security feature that scans apps for malware before they are installed. Make sure this feature is enabled to help prevent future infections. If you have disabled it for any reason, now is the time to turn it back on.

Be Wary of Third-Party App Stores

Avoid downloading apps from third-party app stores or unofficial websites. These sources are not subject to the same security standards as Google Play, making them more likely to distribute malware-infected apps.

Conclusion

The re-emergence of Necro malware highlights the growing sophistication of mobile malware threats. With 11 million devices infected through Google Play, it’s clear that even trusted platforms are not immune to malware attacks. By understanding how Necro operates and taking steps to protect your device, you can reduce your risk of falling victim to this dangerous malware.

FAQs

1. What is Necro malware?

Necro is a family of malware that targets Android devices. It spreads through legitimate apps, infecting devices by embedding malicious code into the app’s SDK.

2. How does Necro infect devices?

Necro infects devices through legitimate apps, primarily using malicious SDKs. It can also spread through modified versions of popular apps available on unofficial app stores.

3. What should I do if I think my device is infected?

If you suspect your device is infected, uninstall any apps you believe may be compromised, run a security scan using a reputable antivirus program, and ensure that Google Play Protect is enabled.

4. How does Necro use steganography?

Necro uses steganography to hide malicious code within images. This makes it more difficult for antivirus programs to detect the malware, as it appears to be part of a harmless image file.

5. Are apps on Google Play safe?

While Google Play is generally considered safe, it’s not immune to malware. Always check app reviews and permissions, and enable Google Play Protect to add an extra layer of security.

Source: Google News

Read more blogs: Alitech Blog

www.hostingbyalitech.com

www.patriotsengineering.com

www.engineer.org.pk

Posted in News on Sep 24, 2024



Does your hosting provider has this performance?

Posted in News on Sep 12, 2020

Does your hosting provider has this performance? If no... you need to move now 🙂 https://hosting.alitech.uk



AI-powered Web Hosting and Its Benefits

Posted in Uncategorized on Jul 10, 2024

AI-powered web hosting leverages artificial intelligence technologies to manage, optimize, and enhance traditional web hosting experiences. It offers unparalleled benefits such as enhanced performance and speed, improved security measures, efficient resource management, and intelligent traffic analysis. This type of hosting integrates AI to predict traffic patterns, dynamically allocate resources, and ensure superior website performance. Businesses adopting AI-powered web hosting can expect faster load times, automated threat detection, and scalable solutions that cater to growing needs. As AI technology continues to evolve, the future of web hosting looks promising, offering even more sophisticated and efficient solutions.



Google’s New Verified Checkmarks in Search: A Game-Changer for User Trust

Posted in News on Oct 08, 2024

As we navigate the digital age, online trust has become increasingly important. Google is now experimenting with a feature that aims to strengthen this trust: verified checkmarks in search results. These blue ticks could soon help users easily identify which businesses are legitimate and trustworthy. But what does this mean for the average internet user? Let’s dive deeper into this new feature and explore its implications.



Razer Enters AI Market with New Gaming Assistant Project Ava

Posted in News on Jan 08, 2025

Razer's Project Ava, an AI-powered gaming assistant, is set to revolutionize the gaming industry with real-time strategic advice, post-match coaching, and hardware optimization, catering to both esports professionals and casual players alike.



[SOLVED / FIXED] Python Django - TypeError: can't multiply sequence by non-int of type 'float'

Posted in Technical Solutions on Apr 02, 2022

[SOLVED / FIXED] Python Django - TypeError: can't multiply sequence by non-int of type 'float' Error: Language : Python Django TypeError: can't multiply sequence by non-int of type 'float'<strong>SOLUTION / FIX



Brazil Lifts Ban on X After Elon Musk Pays $5M Fine

Posted in News on Oct 09, 2024

In a major development in Brazil’s tech and social media landscape, the country’s Supreme Court recently lifted a ban on X, the platform formerly known as Twitter. This decision came after a long standoff between the platform, owned by billionaire entrepreneur Elon Musk, and the Brazilian government over issues of disinformation and legal compliance. Musk’s company, X, paid a hefty $5 million fine and complied with court orders, which has led to the platform’s reinstatement in the country. This article delves into the reasons behind the ban, Musk’s response, and how the situation has unfolded, ultimately leading to X’s return to one of its most significant markets.



Experience Unmatched Performance with LiteSpeed: A Comparison

Posted in News on Jun 07, 2024

Discover how LiteSpeed outperforms Nginx and Apache in delivering superior website performance, enhancing user experience for platforms like Magento and WordPress.



How to Install Python 3.10 on Ubuntu 20.04 LTS & Ubuntu 18.04

Posted in Technical Solutions on Jan 02, 2022

How to Install Python 3.10 on Ubuntu 20.04 LTS & Ubuntu 18.04 Python is a programming language that lets you work more quickly and integrate...



Meta Connect 2024: A Deep Dive into Meta's New AI Features and Llama 3.2

Posted in News on Sep 27, 2024

Meta Connect 2024 unveiled a suite of groundbreaking AI features that are set to reshape user experiences across Meta's apps. At the heart of these innovations is Llama 3.2, Meta’s latest large language model with multimodal capabilities, allowing it to process both text and images. This model powers everything from intuitive image editing to real-time voice interactions and seamless translation. Additionally, Meta's AI Studio lets users create lifelike chatbots, while the introduction of AI-powered voice assistants and real-time dubbing highlights Meta's commitment to pushing the boundaries of artificial intelligence



[SOLVED / FIXED] Django error 400 bad request

Posted in Technical Solutions on Jul 04, 2021

[SOLEVED] Django error 400 bad request



AI Wins Another Nobel: DeepMind’s Hassabis and Jumper Awarded for AlphaFold Breakthrough in Chemistry

Posted on Oct 10, 2024

The 2024 Nobel Prize in Chemistry marked a groundbreaking moment, as artificial intelligence once again took center stage. This time, the honor went to Demis Hassabis, co-founder of Google DeepMind, and John Jumper, Senior Research Scientist at the same institution, for their revolutionary AI system, AlphaFold. Alongside them was David Baker from the University of Washington, whose work in protein design complemented the AI-driven breakthroughs. This prestigious award recognized their joint contributions to predicting and developing new proteins, a breakthrough that is already changing the world of biology and chemistry.



Google’s $2.7 Billion Move to Rehire AI Genius: Noam Shazeer's Return to the Search Giant

Posted in News on Sep 26, 2024

In the rapidly evolving landscape of Artificial Intelligence, Noam Shazeer's return to Google in a staggering $2.7 billion deal marks a significant turning point. Once a key player at Google, Shazeer left in frustration over the company's cautious approach to AI innovation. He co-founded Character.AI, which achieved remarkable success in creating conversational agents. However, as competition in AI intensified, Google recognized the value of Shazeer's expertise and technology, leading to a strategic acquisition aimed at revitalizing its AI capabilities. His role in developing Gemini, Google’s next-gen AI model, could redefine the company's position in the fiercely competitive AI market.



Python Django Static Files Setup

Posted in Technical Solutions on Jul 05, 2022

Python Django Static Files Setup



Chrome's 'Listen to this page' Now Lets You Hear Articles While Doing Other Tasks

Posted in News on Oct 21, 2024

Google Chrome has introduced an updated version of its "Listen to this page" feature, now allowing users to listen to web articles while multitasking. The new background playback feature ensures that audio continues even when switching apps or locking the phone, making it more convenient for busy users. This update, part of Chrome 130 for Android, includes enhanced controls, customizable voice options, and seamless integration with notifications for easy access. Perfect for professionals and users who prefer listening over reading, this feature boosts both accessibility and productivity.



WhatsApp Beta Users Face Green Screen Issue: Here’s How to Solve the Problem

Posted in Technical Solutions on Nov 11, 2024

WhatsApp beta users on Android are currently facing a frustrating green screen issue that makes their devices unresponsive when trying to open a chat. This bug is specifically affecting those on beta version 2.24.24.5, causing the screen to turn solid green and preventing access to messages. Fortunately, there are several solutions to this problem, from force-closing the app to switching back to the stable version. Discover how you can resolve this issue and get your WhatsApp back to normal.



AI-Generated Captions Come to Max via Google

Posted on Sep 25, 2024

Warner Bros. Discovery has partnered with Google to launch "Caption AI," an innovative tool that uses AI technology to automatically generate captions for unscripted programming on the Max streaming service. Built on Google’s Vertex AI platform, this collaboration aims to cut captioning costs by up to 50% and reduce production time by 80%. As the media industry increasingly embraces AI, this partnership highlights the potential of technology to streamline processes while maintaining quality and accuracy in content accessibility.



Awesome Partners - Hosting by AliTech

Posted in Uncategorized on May 24, 2021

We are pleased to announce that CyberPanel has chosen us as their Awesome Partner!!! Along with other superb & awesome partners we are cordially welcoming CyberPanel. #hostingbyalitech #alitech #cyberpanel #litespeed #openlitespeed #partnership #partners #awesome #we #are #welcoming https://www.hostingbyalitech.com



[SOLVED / FIXED ] Kubernetes / Docker could not create directory. wordpress

Posted in Technical Solutions on Apr 30, 2022

[SOLVED / FIXED ] Kubernetes / Docker could not create directory. wordpress ERROR: could not create directory SOLUTION / FIX: chown -R www-data:www-data /var/www




Other Blogs


Does your hosting provider has this performance?

Posted in News on Sep 12, 2020 and updated on Oct 23, 2020

AI-powered Web Hosting and Its Benefits

Posted in Uncategorized on Jul 10, 2024 and updated on Jul 10, 2024

Google’s New Verified Checkmarks in Search: A Game-Changer for User Trust

Posted in News on Oct 08, 2024 and updated on Oct 08, 2024

Razer Enters AI Market with New Gaming Assistant Project Ava

Posted in News on Jan 08, 2025 and updated on Jan 08, 2025

Brazil Lifts Ban on X After Elon Musk Pays $5M Fine

Posted in News on Oct 09, 2024 and updated on Oct 09, 2024

Experience Unmatched Performance with LiteSpeed: A Comparison

Posted in News on Jun 07, 2024 and updated on Jun 07, 2024

How to Install Python 3.10 on Ubuntu 20.04 LTS & Ubuntu 18.04

Posted in Technical Solutions on Jan 02, 2022 and updated on Jan 02, 2022

Meta Connect 2024: A Deep Dive into Meta's New AI Features and Llama 3.2

Posted in News on Sep 27, 2024 and updated on Sep 27, 2024

[SOLVED / FIXED] Django error 400 bad request

Posted in Technical Solutions on Jul 04, 2021 and updated on Jul 28, 2021

Python Django Static Files Setup

Posted in Technical Solutions on Jul 05, 2022 and updated on Nov 27, 2023

Chrome's 'Listen to this page' Now Lets You Hear Articles While Doing Other Tasks

Posted in News on Oct 21, 2024 and updated on Oct 21, 2024

AI-Generated Captions Come to Max via Google

Posted on Sep 25, 2024 and updated on Sep 25, 2024

Awesome Partners - Hosting by AliTech

Posted in Uncategorized on May 24, 2021 and updated on May 28, 2021







Comments

Please sign in to comment!






Subscribe To Our Newsletter

Stay in touch with us to get latest news and discount coupons