There was no identifying information on the PDF - there was a date, a semblance of a title, but no authoring body, and the headers and footers offered only a variation of the title. Even Google can’t thoroughly scan the millions of apps in the Play store and, as a result, malware can slip through the cracks and end up in apps that have been vetted.Peter, a work colleague, wanted to know how to reference a PDF he’d located on a government website. These findings highlight that any app, even a legitimate one from an official store with positive reviews, can be updated to contain malware. While it seems the app’s developers removed the malicious code in the latest update, researchers warn that versions of the app vary from device to devices, and some may still contain the malware. When Kaspersky Lab researchers analyzed a recent version of the app and found the malicious module, they reported their findings to Google, and CamScanner was removed from Google Play. As a result, the module’s owners can use an infected device any way they want for example, they could push false advertisements to the screen or charge victims paid subscriptions to benefit from financial gain. This “dropped” malware, they explain, can download more malicious code. When CamScanner is run, the module extracts and runs a payload from an encrypted file in the app’s resources.
At some point, things changed, and analysis shows the app was updated with an advertising library containing a malicious dropper component. CamScanner relied on ads and in-app purchases to make money. The PDF creator is legitimate and has been downloaded more than 100 million times, Kaspersky Lab researchers report, noting recent reviews indicated unwanted features. CamScanner, an Android app commonly used to scan and organize electronic documents, was found to contain malicious components to download malware onto infected Android devices.
0 kommentar(er)
