- More malware from Android apps has been found and removed from the Google Play Store, this time in the form of an app called Barcode Scanner.
- The researchers found that the app looked legitimate at some point and had accumulated about 10 million installations before the incomplete code was added, turning it into malware.
- Google removed the app from the Play Store, but users will still need to remove the app from their own Android devices, if they have it.
Hackers and evildoers get more and more creative when it comes to trying to slide nefarious apps beyond the defenses of the Google Play Store, something we approached more and more regularly throughout 2020 – a year in which we saw one example after another of lots of incomplete Android apps taking advantage of users and launching quickly in the Google app store.
Examples included this batch of 24 Android apps, covering everything from weather to calendar and camera functionality, some of which were loaded with malware and requested incomplete permissions. Google kicked them out of the store, but not before they accumulated about 382 million downloads. The same is true for this group of Android apps that may have stolen users’ login data on Facebook, which generated about 470,000 downloads. In the meantime, here we are, in 2021, and the Android app malware machine is back up and running at high speed – with a particularly incomplete Android app recently identified and kicked out of the Play Store after accumulating around 10 million installations.
Best deal of the day 
How is this Alexa speaker paying only $ 15 today on Amazon? List price:$ 34.98 Price:$ 14.99 You save:$ 19.99 (57%) 
Available on Amazon, BGR can receive a commission Available on Amazon BGR can receive a commission
Through Malwarebytes, we learned about an app called Barcode Scanner that has been available on the Play Store for years. This led to the accumulation of the 10 million installations we mentioned.
This application was intended to provide the user with a barcode generator and a QR code reader. So far so good. In fact, things have apparently remained this way, seemingly legitimate, for years. But things have changed a lot recently. “At the end of last December,” notes the Malwarebytes report, “we started receiving a distress call from our forum customers. Users were seeing ads that opened through their default browser out of nowhere. The strange part is that none of them installed any apps recently, and the apps they installed came from the Google Play Store. “
Finally, a forum user determined that the problem came from an application that had been installed some time ago: the Barcode Scanner. Malwarebytes says it quickly added detection, and Google removed the app from the Play Store shortly thereafter.
The update that appears to have moved this app (“from an innocent scanner to full malware!”, Notes the report) occurred in early December – and by the way, although Google has removed the app from its own market, you still need to clean it from your Android device, if you have one. In addition, this link will show a video that describes what the app has done with infected phones.
It appears that malicious code was inserted into the application that did not exist in previous versions of the application, according to the researchers. And the new code snippet used “heavy obfuscation” to try to avoid being detected. “Because of its malicious intent, we have surpassed our original Adware detection category straight into the Trojan,” adds the report, in a summary that you can check in full here.
Best deal of the day How is this Alexa speaker paying only $ 15 today on Amazon? List price:$ 34.98 Price:$ 14.99 You save:$ 19.99 (57%) Available on Amazon, BGR can receive a commission Available on Amazon BGR can receive a commission
Andy is a reporter in Memphis who also contributes to vehicles like Fast Company and The Guardian. When not writing about technology, he can be found perched protectively on his burgeoning vinyl collection, as well as nurturing his Whovianism and devouring a variety of TV shows that you probably don’t like.