Downloading various apps blindly from Google play store may bring you at risk in terms of money.
PandaLabs, the Cloud Security Company, has identified malicious Android apps on Google Play that can sign up users for premium SMS subscription services without their permission and so far it has infected at least 300,000 Android users, although the number of malicious downloads could have reached 4 times higher i.e. 1,200,000 users.
The four apps found free in the app store that came packaged with a premium SMS scam that dubbed as "Easy Hairdos", "Abs Diets", "Workout Routines" and "Cupcake Recipes" and are among the malicious apps available for free download on Google Play store.
From the above app, say if 'Abs Diet' has been installed on your phone and once the user has accepted the terms and conditions of the service, the app displays a series of tips to reduce abdominal fat and then without the user's knowledge, the app looks for the phone number of the mobile device, connects to a Web page and signs the victim up to a premium SMS subscription service.
"Without the user knowledge the app will get the phone number of the device, will go to a website and will register it to a premium SMS service. This service requires a confirmation to be activated, which means it sends an SMS to that number with a PIN code, which have to be entered back to end the process and start changing you money," states the blog post.
"This app waits for that specific message; once it arrives, it intercepts its arrival, parses it, takes the PIN number and confirms your interest in the service. Then it removes it, no notification is shown in the terminal and the SMS is not shown anywhere. Again, all this is done without the user knowledge."
But the question is from where this app acquired the telephone number?
In this case, the app steals your phone number from one of the most popular mobile apps in the world, WhatsApp. As you probably remember, the first time when you have installed WhatsApp on your phone, you were asked to provide your mobile phone number. The popular messaging app uses this number, among other things, as an identifier to synchronize with WhatsApp.
According to Google Play Store this app has between 50,000 and 100,000 downloads. So I think your math is enough to calculate the affected users' parameters.
The researchers at Panda Labs estimated that the average scammed user gets charged $20 by these apps and somewhere between 300,000 and 1,200,000 users downloaded them, so it is guessed that the scammers could have made between $6 million and $24 million from unsuspecting users.
It's not at all surprising that Google play store, that has a huge number of lists of apps, contains some malware affected apps, but this new surge of malware has hit the Google's play store which has infected over 300,000 Android users.
So, users are advised to always carefully read the permissions while installing every app to their phones and if any app that seeks to read SMS and want to connect to the Internet but accordingly such connection is not really needed, then Do Not Install It.
