Scam and dangerous apps are a problem for both Apple and Google app stores. A security research firm has now detailed how a recording app turned malicious and recorded nearby audio every 15 minutes and sent it to developer. The app, named iRecorder – Screen Recorder, has now been removed by Google from the Play Store.
Downloaded more than 50,000 times
As per the report, the app had over 50,000 installs. First introduced in September 2021, the app wasn’t malicious to begin with. “However, around August 2022 we detected that the app’s developer included malicious functionality in version 1.3.8,” noted the security researcher Lukas Stefanko.
Android users who had installed an earlier version of iRecorder (prior to version 1.3.8), which lacked any malicious features, would have unknowingly exposed their devices, Stefanko added.
How the app became malicious
Stefanko explained that two malicious codes based on AhMyth RAT were identified in the app. “AhMyth RAT is a potent tool, capable of various malicious functions, including exfiltrating call logs, contacts, and text messages, obtaining a list of files on the device, tracking the device location, sending SMS messages, recording audio, and taking pictures” explained Stefanko.
Upon installation of the malicious app, it behaved as a standard app without any special extra permission requests that might have revealed its malicious intentions. “AhRat’s malicious behaviour, which includes recording audio using the device’s microphone and stealing files with specific extensions, might indicate that it was part of an espionage campaign,” he added.
As mentioned above, Google did remove the app after ESET had alerted them about malicious code in the app. Google hasn’t officially commented on the removal of the app but Stefanko did say that the it has been removed. Recording apps are a common category of scam apps as they often offer features that can lure users.
Downloaded more than 50,000 times
As per the report, the app had over 50,000 installs. First introduced in September 2021, the app wasn’t malicious to begin with. “However, around August 2022 we detected that the app’s developer included malicious functionality in version 1.3.8,” noted the security researcher Lukas Stefanko.
Android users who had installed an earlier version of iRecorder (prior to version 1.3.8), which lacked any malicious features, would have unknowingly exposed their devices, Stefanko added.
How the app became malicious
Stefanko explained that two malicious codes based on AhMyth RAT were identified in the app. “AhMyth RAT is a potent tool, capable of various malicious functions, including exfiltrating call logs, contacts, and text messages, obtaining a list of files on the device, tracking the device location, sending SMS messages, recording audio, and taking pictures” explained Stefanko.
Upon installation of the malicious app, it behaved as a standard app without any special extra permission requests that might have revealed its malicious intentions. “AhRat’s malicious behaviour, which includes recording audio using the device’s microphone and stealing files with specific extensions, might indicate that it was part of an espionage campaign,” he added.
As mentioned above, Google did remove the app after ESET had alerted them about malicious code in the app. Google hasn’t officially commented on the removal of the app but Stefanko did say that the it has been removed. Recording apps are a common category of scam apps as they often offer features that can lure users.
