Google Play Hosts Dangerous Malware Intended For State-Style Surveillance

From the looks of it, it seems the tech world is becoming a more dangerous place than most people realize. The Google Play online store was apparently fooled to host apps that contain malicious software intended for state-type surveillance. These are already being treated as something that would be sponsored by entire countries.

Recently discovered by security researchers, these mobile advanced persistent threats (mAPTs) reportedly come from two separate groups, Ars Technica reports. According to the head of threat intelligence over at the mobile security firm Lookout, Michael Flossman, the target is likely the Middle East.

So far, three apps have been identified to fall into this category and they have since been removed from the Google Play Store. Unfortunately, they have already been downloaded up to 1,250 times, so there could be users out there carrying some very dangerous apps. It would also seem that the malware fall under the ViperRat and the Desert Scorpion families.

"The existence of ViperRAT and Desert Scorpion on Google Play showcases that actors are continuing to 'tune' their malware to get past early stage detections and make it into first-party app stores," Flossman told the publication via email. "These techniques include not shipping the malicious functionality of an app until a second stage that is triggered by some behavior. Surveillanceware is able to hide its malicious functionality in the noise of social networking and chat apps because they request many of the same permissions."

As ZDNet notes, the fact that these apps were downloadable from the Google Play store made them more credible than they should have been, which is why they were downloaded as many times as they were before detection. This is a problem since users rely on app stores to scan the apps that they add to listings so that they wouldn’t be able to pose such threats.