--- title: 'Malicious App Targets Online Shoppers' url: 'https://blog.datum-consulting.com/blog/malicious-app-targets-online-shoppers' markdown: 'https://blog.datum-consulting.com/blog/malicious-app-targets-online-shoppers.md' date: '2020-01-23' description: 'Security researchers have discovered a malicious app that not only targets Android users with unsolicited ads but also downloads and installs scores of online shopping apps on the device and leaves fake reviews on behalf of the user, all whilst hiding from the device owner. In a report published by…' taxonomy: category: - blog tag: - cybersecurity - hacker - 'cyber criminal' - 'cyber attack' - malware - scam - trojan month: - January archives_month: - jan_2020 archives_year: - '2020' --- # Malicious App Targets Online Shoppers [ Home ](https://blog.datum-consulting.com/) Malicious App Targets Online Shoppers ## [Malicious App Targets Online Shoppers](https://blog.datum-consulting.com/blog/malicious-app-targets-online-shoppers) 23rd Jan 2020 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [hacker](https://blog.datum-consulting.com/tag:hacker#body-wrapper) [cyber criminal](https://blog.datum-consulting.com/tag:cyber%20criminal#body-wrapper) [cyber attack](https://blog.datum-consulting.com/tag:cyber%20attack#body-wrapper) [malware](https://blog.datum-consulting.com/tag:malware#body-wrapper) [scam](https://blog.datum-consulting.com/tag:scam#body-wrapper) [trojan](https://blog.datum-consulting.com/tag:trojan#body-wrapper) Security researchers have discovered a malicious app that not only targets Android users with unsolicited ads but also downloads and installs scores of online shopping apps on the device and leaves fake reviews on behalf of the user, all whilst hiding from the device owner. In a [report](https://securelist.com/smartphone-shopaholic/95544/) published by global cybersecurity and anti-virus brand Kaspersky Labs earlier this month, security researchers said they came across a malicious Trojan malware-laced app on the Google Play Store called Trojan-Dropper.AndroidOS.Shopper.a. ##### How does it operate? The “Shopper” app tricks users into downloading it by disguising itself with a system icon and a ConfigAPKs name that bears a striking resemblance to the name of a legitimate Android application. Once it’s installed on to an Android device, the [malware](hackers-malware-data-breaches) gets to work, starting with harvesting device information such as country, network type, vendor, smartphone model, email address, IMEI, and IMSI. The collected data is then relayed to the attackers’ command-and-control servers which will send respond with a series of commands to be run on the targeted smartphone or tablet. The operators’ then mobilize the Shopper.a Trojan to boost the ratings of other malicious apps on the Play Store and post fake reviews on behalf of the victims such as “very easy to use” and “love this app.” The malicious app also starts downloading apps from a third-party app marketplace and installs them on the device without the knowledge of the user. These include popular apps like Alibaba, Shein, MakeMyTrip, Hotstar, and others. ##### Master of Disguise All this is done without the knowledge of the user using the app’s “invisible window” by abusing the Accessibility Service, a known tactic used by Android malware to perform malicious activities without the consent or permission of the user. “The lack of installation rights from third-party sources is no obstacle to the Trojan — it gives itself the requisite permissions through Accessibility Service,” Kaspersky Lab researcher Igor Golovin explained. “With permission to use it, the malware has almost limitless possibilities for interacting with the system interface and apps. For instance, it can intercept data displayed on the screen, click buttons, and emulate user gestures.” The malware also disables the Google Play Protect mobile threat protection service, Google’s built-in Android malware protection, so that it can go about its business without a hitch. ##### What can the “Shopper” malware do? Depending on what commands it receives from its control center, the malicious Shopper.a can perform one or more of the following tasks: - Open links received from the remote server in an invisible window (whereby the malware verifies that the user is connected to a mobile network). - After a certain number of screen unlocks, hides itself from the apps menu. - Check the availability of Accessibility Service rights and, if not granted, periodically issue a phishing request to the user to provide them. - Disable Google Play Protect. - Create shortcuts to advertised sites in the apps menu. - Download apps from the third-party “market” Apkpure.com and install them. - Open advertised apps on Google Play and “click” to install them. - Replace shortcuts to installed apps with shortcuts to advertised sites. - Post fake reviews supposedly from the Google Play user. - Show ads when the screen is unlocked. - Register users through their Google or Facebook accounts in several apps. | ##### How to identify fake or malicious apps on Google Play Store? - When searching for an app on the Play Store, you might come across one or more apps with a similar name. One of the ways to identify fraudulent apps is by looking out for spelling mistakes in in the app’s name and description before downloading the app. - While checking the app’s description page for more information, keep an eye out for tags like “Editor’s Choice” or “Top Developer” as these apps are less likely to be malicious in nature or fake. You can also visit the publisher website to be extra careful before downloading it. - When downloading popular apps like WhatsApp, Facebook, PUBG Mobile, and more, the number of downloads will definitely be higher and usually in the millions. However, if an app has a downloads count of about 5,000 or less, chances of it being a fake app are higher. - Lastly, and most importantly, look at the permissions that the app is asking for. For example, if you’ve downloaded a third-party messaging app, it will request permission to access your contacts and maybe storage for backup. However, if it asks for permission to use your camera or microphone, it means something’s fishy. | |---| [ Previous Post](https://blog.datum-consulting.com/blog/are-you-phishproof) [Next Post ](https://blog.datum-consulting.com/blog/tax-identity-theft-awareness) #### Related Posts - 100 [How Hackers Get Your Passwords and How To Defend Yourself](https://blog.datum-consulting.com/blog/hackers-get-passwords "How Hackers Get Your Passwords and How To Defend Yourself") - 100 [How to Keep Your Company Safe from Russian Hacks](https://blog.datum-consulting.com/blog/russian-hacks-safety "How to Keep Your Company Safe from Russian Hacks") - 100 [Data Privacy Week: 6 Best Practices for Your End Users](https://blog.datum-consulting.com/blog/data-privacy-week "Data Privacy Week: 6 Best Practices for Your End Users") - 100 [Cybercriminals To Impersonate Delivery Firms in Black Friday Phishing Scams](https://blog.datum-consulting.com/blog/black-friday-scams "Cybercriminals To Impersonate Delivery Firms in Black Friday Phishing Scams") - 100 [How Cybercriminals Penetrate Corporate Networks](https://blog.datum-consulting.com/blog/common-initial-attack-vectors "How Cybercriminals Penetrate Corporate Networks") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [Tax Identity Theft Awareness Week](https://blog.datum-consulting.com/blog/tax-identity-theft-awareness.md) - Next: [Are You PhishProof?](https://blog.datum-consulting.com/blog/are-you-phishproof.md)