36 Fake Security Apps in the Google PlayStore Downloaded Malware, Stole Data, Tracked Locations

In December 2017, Trend Micro researchers found 36 security apps in the Google Play Store that secretly stole user data, tracked their location, and pushed advertisements.
Google has since removed the apps from the Play store.
What if the security apps you download to keep your Android device safe are actually vehicles for malware themselves? Security firm Trend Micro recently discovered 36 apps in the Google Play Store with names such as Security Defender, Security Keeper, and Smart Security, that claimed to keep devices safe but actually stole user data, tracked user locations, and heavily pushed advertisements.

These findings, detailed in a blog post from Trend Micro mobile threat analyst Lorin Wu, highlight the need to be vigilant with security practices when it comes to corporate devices and data in particular.

The apps claimed to perform tasks such as scanning phones, saving battery, cleaning junk, and offering message and Wi-Fi security, the post noted. While they did complete those tasks, they also downloaded adware, and malware that constantly gave users false "security alerts" to make the app seem more legitimate.

While users are asked to sign an end-user license agreement that acknowledges the information that will be gathered by the app, it is still an abuse of user privacy, because collecting and saving that information is unrelated to how the app works, Wu noted.

The apps upload user data including Android ID, Mac address, brand and model of the device, location information, and information on installed apps to a remote server. It remains unknown why the attackers were collecting this information, though it was clearly a huge breach of privacy, as noted by our sister site ZDNet.



 Trend Micro notified Google about the apps, and they have since been removed from the Play Store, the post noted.



Always update your device to the latest version, to take advantage of any patches to apps and software
Only download apps from trusted sources, and check reviews before downloading
Check the privacy settings for each app you download, as some release your location or other personal information by default
Check what permissions apps have required, and if they are greater than necessary
Invest in trusted, multilayered mobile security solutions