Android malware infects 60 apps with over 100 mn downloads on Google Play Store

The Android malware was discovered by a team of researchers at McAfee and they found that it collects sensitive device and personal information of users. In addition to this, the Android malware can also click ads in the background thereby causing ad fraud without no knowledge of the user. Goldoson appears to have targeted Android users in South Korea who downloaded apps from not just the Play Store but from a third-party app store called “ONE”.

How the Android malware ‘Goldson’ works

Once the infected app with the malware enters a user’s device, it will register the device and get access through remote configurations at the same time. It will then periodically check and send device information to remote servers. The malware can even load web pages without the knowledge of the user. According to McAfee, the data is sent out every two days but this can change. 

As for the information that is being sent out, it includes “the list of installed applications, location history, MAC address of Bluetooth and Wi-Fi nearby, and more.” The infected apps on the Play Store have over 100 million downloads, and those on the ONE store have around 8 million installs. 

Also, among the list of apps that were infected with the malware there are some popular ones in South Korea. These include the music streaming app Genie, payment app L.POINT with L.PAY, gaming app Swipe Brick Breaker, Lotte Cinema app, Lotte World Magicpass, and more.  

McAfee in its blogpost said that the malware and infected apps were reported to Google, and the same was later conveyed to the app developers. Some of these apps were removed from the Play Store but for the others, an update with a fix has been issued by the developers. It is advised that users who have any of these apps on their phone update it to the latest version.