Google Play

Two malicious file management apps were found on the Play Market, with a total of more than 1.5 million installed. They gathered a wealth of information that went far beyond the data needed for their work, and then sent the collected information to China.

• The first application is called. File Recovery and Data Recovery and has achieved at least one million installations.
• Second, under the name File ManagerIt has been downloaded at least 500,000 times.

This is what malware logos look like / Pradeo screenshots

In their statement, in the Data Security section, they stated that they did not collect any personal user data, but that was a lie. Analysts say both programs add up:

• List of contacts in smartphone memory.
• Data about connected email and social media accounts.
• Pictures, audio and videos that have been manipulated or restored by malware.
• User’s location in real time.
• Mobile country code.
• The name of the communication operator.
• Network code of the SIM provider.
• Operating system version.
• The make and model of the device.

While some apps may collect this type of data to work, it’s clear that file managers don’t need it. Worse still, the information was collected secretly and without users’ consent.

app store

According to the source, the strange software was discovered on the Indian App Store. These are six applications disguised as financial services – investment, loan, etc. robbing and even blackmailing users.

Pocket Kash, White Kash, Golden Kash, OK Rupee and two other public institutions reportedly demanded exorbitant amounts of money from defrauded users under the guise of cheap loans. Extortion transactions were announced on the grounds of “application processing fees” and other reasons. The amount that apps pulled from iPhone users sometimes reached half of the credit they received.

But that’s not all. After paying the brutal fees and getting the credit, the user received a request for access to the contacts. If allowed, the app instantly downloaded the entire list of phone numbers to the server and started blackmailing the client: The program threatened to send private photos to anyone, replacing his face with pornographic images from the Internet.

All detected apps are now removed from the App Store. However, it is not yet clear what to do for those who suffer from them.