(Photo Illustration by Samuel Boivin/NurPhoto via Getty Images)
A hacker has been using a fake Starlink app and spoofed Google Play Store pages to trick users into installing Android malware.
Antivirus provider Kaspersky warns that the threat can secretly install a cryptocurrency miner and a remote access Trojan on an Android phone, enabling the hacker to hijack the device. So far, the malware has targeted users in Brazil, which has become Starlink’s second-largest customer base, with over 1 million users.
Initially, the hacker was spreading the malware through a fake Google Play Store on the web domain cupomgratisfood[.]shop. The fake store contained an app that pretended to come from Brazil’s social security system, which Kaspersky analyzed and found to be malicious. Recently, the antivirus vendor has also detected the threat circulating on the fake Starlink app.
(Credit: Kaspersky )If installed, the malware usually functions by first displaying a fake Google Play Store window that says the app needs to download an update. But in reality, it’s a trick meant to dupe the user into granting Android device permissions, paving the way to execute the full attack.
(Credit: Kaspersky )“The payload delivery process mimics the application update. The malware uses the REQUEST_INSTALL_PACKAGES permission to install APK files directly into its memory, bypassing Google Play,” Kaspersky adds.
The malware will then download a program to secretly harness the Android phone to mine the Monero cryptocurrency. In addition, the attack delivers one of two types of Trojans that enable the hacker to remotely monitor and hijack the device's functions. This can include controlling the phone’s cameras and capturing “screen lock credentials, including PINs, patterns and passwords on compromised devices,” Kaspersky says.
One interesting component of the malware is how it’ll play “an almost inaudible audio file on a loop so it cannot be terminated,” Kaspersky warns. The function is also why the antivirus vendor has named the threat “BeatBanker.”
The threat is a reminder that it’s best to download Android apps from the official Google Play Store, and to check that the program comes from an official developer, rather than an unknown programmer with few reviews. Users can also consider installing an Android antivirus app. (Kaspersky’s antivirus was removed from Google Play in 2024 due to US-imposed restrictions.)