Two recently discovered malicious Android apps related to the nefarious Ztorg family have been removed from the Play Store by Google. They were capable of sending premium-rate text messages to numbers controlled by the attackers and hid their tracks by deleting incoming messages, according to researchers at antivirus firm Kaspersky.
Collectively, these two apps — dubbed "Magic browser" and "Noise Detector" — had been installed from Google Play more than 60,000 times, Kaspersky Lab Senior Malware Analyst Roman Unuchek wrote in a Tuesday blog post. Magic browser, uploaded to Google Play on May 17, masqueraded as an "ultra-fast, simple and practical mobile browser," while Noise Detector promised to let you "easily measure the noise level of the current environment."
Before they were deleted, Magic browser had already been downloaded 50,000 times while Noise Detector racked up 10,000 downloads.
Unuchek said he's been monitoring the Google Play Store for Ztorg trojans since September 2016 and has found "several dozen" malicious apps in that time, all of which used exploits to gain root access on the infected device. Magic browser and Noise Detector, which he discovered in the second half of May, are a little different.
They're "related to the Ztorg Trojans, although not a rooting malware," Unuchek wrote. Instead, they're SMS trojans "that can send Premium rate SMS [text messages] and delete incoming SMS."
Kaspersky Lab reported the malware to Google and both apps have been deleted from the Play Store.
In other Android news, Google this week announced plans to end support for the Android Market app on Android 2.1 Éclair and older devices on June 30. Once the change goes into effect, users on these devices will no longer be able to access or install apps from the Android Market.
"It has been 7 years since Android 2.1 Eclair launched," Google Play Software Engineer Maximilian Ruppaner wrote in a blog post. "Most app developers are no longer supporting these Android versions in their apps given these devices now account for only a small number of installs."