ANDROID owners have been warned about a malicious app that can steal their data.
Cybersecurity experts from ESET have uncovered a malware-laden app lingering on the Google Play store.
The app, dubbed iRecorder – Screen Recorder, has been on the store since September 19, 2021, and has well over 50,000 downloads.
However, ESET revealed that malware wasn’t embedded into the software until around August 2022.
The cybersecurity experts noted that it’s unusual for a developer to upload a legitimate app and then update it with malicious code many months later.
“The malicious code that was added to the clean version of iRecorder is based on the open-source AhMyth Android RAT (remote access trojan) and has been customized into what we named AhRat,” ESET said.
As of right now, this appears to be the only AhRat malware in the wild affecting Android devices.
But, it is not the first time that AhMyth-based Android malware has been easily available on Google Play.
While the app does provide legitimate screen recording functionality, it can also steal files on your phone.
This includes saved web pages, images, audio, video, and document files, and file formats used for compressing multiple files.
“The app’s specific malicious behavior – exfiltrating microphone recordings and stealing files with specific extensions – tends to suggest that it is part of an espionage campaign,” ESET said.
“However, we were not able to attribute the app to any particular malicious group,” the company added.
After ESET identified the application and notified Google, the app was promptly removed from the store.
For starters, it’s important to always keep your device updated with the latest software and antivirus protection.
You should also avoid installing apps from unofficial app stores. And even if an app is on Google’s Play Store, you should remain vigilant about its legitimacy.
Furthermore, you should never download anything from strange pop-up windows.
It can also be helpful to read user reviews and keep Google’s Play Protect feature active.
