Android App Update Turns Popular App Into Spyware with 50,000 Downloads

Android App with 50,000 Downloads in Google Play Turned into Spyware via Update

On May 24, 2023, the cybersecurity firm ESET reported that a screen recording application called “iRecorder – Screen Recorder” that had more than 50,000 downloads in Google Play was trojanized through an update. Initially published without malicious functionality in September 2021, the app was injected with the AhRat Trojan via an update to version 1.3.8 in August of the same year. AhRat is a remote access trojan based on the AhMyth RAT that allows attackers to record audio, exfiltrate files from infected devices, and carry out espionage campaigns. Although AhMyth is a cross-platform RAT previously used by Transparent Tribe and Mythic Leopard, the AhRat observed in this incident could not be linked to any known advanced persistent threat (APT) actor. Both versions of the iRecorder application contained a limited set of malicious features compared to AhMyth RAT.

Malware in Google Play

Google Play is a popular app store that has been accused of hosting malicious applications in the past. According to ESET, the AhRat trojan injected into iRecorder – Screen Recorder through an update demonstrates the challenge of detecting malware in app stores, even if they are curated. With over 50,000 downloads, the popular screen recording application shows how a seemingly harmless app can quickly become a channel for cybercriminals to gain access to devices and their data. Malware authors often use legitimate-looking applications that already have a large user base as a means of penetrating a system unnoticed. It is unknown whether the app developer was aware of the compromise or whether the application had been developed with malicious intent from the beginning.

Privacy and Security Implications of Spyware

When spyware infects a device, it silently records and exfiltrates sensitive information, such as user credentials, intellectual property, financial data, and personally identifying information. This data can then be used for financial gain, identity theft, or espionage. Spyware can infiltrate a device via a malicious application, spear-phishing campaigns, or drive-by downloads, among other attack vectors. In addition to compromising the privacy of individuals and organizations, spyware can cause reputational damage, legal liability, and financial losses. The prevalence of spyware highlights the importance of proactive security measures and user education regarding cybersecurity best practices, such as avoiding suspicious links, not downloading applications from untrusted sources, and keeping devices updated.

Advice for Users and Organizations

Given that even curated app stores can host malicious applications, users are advised to exercise caution when downloading and using apps, especially those with sensitive permissions. Users should ensure that the app developer has a good reputation, check user reviews, and read the terms and conditions before downloading an app. They should also keep their devices up-to-date with the latest security updates and use antivirus software to prevent malware infections. For organizations, it is essential to conduct security audits, ensure that employees are aware of cybersecurity risks and best practices, and use security technologies such as firewalls, intrusion detection and prevention systems, and security monitoring tools. Organizations should also maintain incident response plans and regularly test those plans to ensure their effectiveness in detecting and mitigating cyberattacks.

Conclusion

The injection of the AhRat trojan into the iRecorder – Screen Recorder application via an update highlights the risk of malicious applications in curated app stores such as Google Play. The incident reiterates the importance of user education, proactive security measures, and robust incident response plans in preventing and mitigating cyberattacks. As mobile devices continue to become an integral part of people’s personal and professional lives, it is crucial to address the security and privacy risks associated with the use of these devices.