A new version of the Necro malware loader infected 11 million Android devices via malicious advertising SDKs in legitimate apps and modified versions of popular software. The malware primarily spreads through unofficial websites and modified apps, but two legitimate Google Play apps were also found to be infected. Kaspersky identified several malicious plugins associated with Necro, including those that display ads, download and execute files, facilitate subscription fraud, and use infected devices as proxies. The total number of infections is unknown, but at least 11 million devices were infected through Google Play.

  • Fizz@lemmy.nz
    link
    fedilink
    English
    arrow-up
    1
    ·
    6 hours ago

    I download a lot of non playstore apps how can I check they don’t have this issue? I don’t think I downloaded anything sketchy but maybe.

    • GenderNeutralBro@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      1
      ·
      5 hours ago

      This is Kaspersky, so the only answer you’re going to get from them is “use Kaspersky Premium”.

      The only non-Play apps they mention in their report are modified versions of otherwise-clean apps (like Spotify or Minecraft). They didn’t mention anything on F-Droid or other app stores.

      • DarkThoughts@fedia.io
        link
        fedilink
        arrow-up
        3
        ·
        3 hours ago

        I’d very highly suggest not to use Russian anti-virus software, regardless which version we’re talking about.

    • ijeff@lemdro.idOPM
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      6 hours ago

      I’m not personally familiar with Android antivirus tools. I’d imagine your best bet is to just not install APKs from random unverified sources.

    • burgersc12
      link
      fedilink
      English
      arrow-up
      1
      ·
      5 hours ago

      If you haven’t donwloaded modded apps you’re probably fine. I read that updating/removing the infected apps should be enough, but idk