McAfee finds fake android app steals the user money

Google has attempted to secure apps in the Play Store. But it turns out there are applications that steal the user's money unnoticed.

The findings obtained research team McAfee Mobile. They found 15 repackaged apps to secretly sign up for premium paid services in the background. Some of these applications are well known, namely Crcod Scanner, Cut Ringtone 2018 and Despacito Ringtone.

When further traced AsiaHitGroup is behind the criminal activity. The group is known to start in action the first time in late 2016. Now they do a similar action by targeting devices that access the Play Store in Malaysia and Kazakhstan.

Instead of creating fake apps, they bundled legitimate Android apps with Sonvpay C. Where using background push notifications in secret and then secretly lead users to subscribe premium paid services.

This app itself does not show threats, even acting very normal. They only ask permission to access SMS messages.

"Subscriptions operate via WAP billing that does not require sending SMS to premium-rate numbers Instead it only requires mobile networks for users to access certain websites and automatically clicks buttons to start the subscription process," explains Carlos Castillo from McAfee Saturday (30/6) / 2018).

The service subscription will be billed directly to the mobile carrier. While users do not agree, subscription fees may appear on mobile bills.
The more complicated, the victims do not know if they subscribe after they receive a monthly report.

Team McAfee after finding Qrcode Scanner, Cut Ringtone 2018 and Despacito Ringtone containing SonVpay.C components, they immediately notify Google and immediately remove the malicious application.

But after a few days more applications appear mixed with Sonvpay.C. Luckily Google instantly acted quickly and immediately removed it from the Play Store.