The Belgian Police warned about the return of the Joker virus , which attacks Android devices and hides itself in various applications on the Google Play Store .
This malware is capable of subscribing the user to payment services without their authorization and emptying their bank accounts without them noticing. “This malicious program has been detected in eight Play Store applications that Google has suppressed,” say the Belgian authorities in a statement published this Friday on their website.
The ‘Joker’ malware became famous in 2017 for infecting and robbing its victims by hiding in different applications. Since then, the Google Play Store defense systems have removed around 1,700 apps with the ‘Joker’ malware before they were downloaded by users.
In September 2020, the ‘Joker’ virus was found in 24 Android applications that registered more than 500 thousand downloads before being removed. It is estimated that that time it affected more than 30 countries including the United States, Brazil and Spain. Through unauthorized subscriptions, hackers could steal up to $ 7 (about 140 Mexican pesos) per subscription weekly, a figure that has most likely increased in recent months.
How does the Joker virus work in Android apps?
The ‘Joker’ Trojan virus belongs to a family of malware known as Bread , whose objective is to hack cell phone bills and authorize operations without the user’s consent.
Researchers from the cybersecurity company Quick Heal Security Lab, cited in the statement, explain that this virus can enter text messages , contacts and other information on the infected smartphone.
What makes this malware more dangerous is its ability to subscribe the affected Android user to paid services , usually Premium or the most expensive version, without their prior authorization.
In the beginning, apps infected with ‘Joker’ or another Malware from this family carried out fraud via SMS , but then began to attack online payments . These two techniques take advantage of the integration of telephone operators with vendors, to facilitate the payment of services with the mobile bill . Both require verification of the device, but not the user, thus they manage to automate payments without requiring any user interaction.
“You risk a big surprise at the end of the month in your bank account or on your credit card,” said the Belgian police, referring to the unknown charges that the victim will see at the end of the month.
In fact, it is very common for those affected by ‘Joker’ to become aware of the theft until they review their account statement in detail. This is because the bank does not suspect an apparently ‘normal’ subscription and, generally, the charges are so small that they are not detected as unusual movements, so they do not even send a usage alert to the account holder.
In which Android apps could the Joker virus be?
On this occasion, the harmful applications that the Google Play Store eliminated after detecting that they contained the ‘Joker’ virus are:
Auxiliary Message
Element Scanner
Fast Magic SMS
Free CamScanner
Go Messages
Super Message
Super SMS
Travel Wallpapers
However, other specialists warn that more apps are affected and, therefore, millions of users who do not know that they are already victims of this cyber fraud.
The cybersecurity company Zscaler, cited by La Razón , made public the names of 16 other apps that, according to their analysis, also contain this malicious code:
Private SMS
Hummingbird PDF Converter – Photo to PDF
Style Photo Collage
Talent Photo Editor – Blur focus
Paper Doc Scanner
All Good PDF Scanner
Care Message
Part Message
Blue Scanner
Direct Messenger
One Sentence Translator – Multifunctional Translator
Mint Leaf Message-Your Private Message
Unique Keyboard – Fancy Fonts & Free Emoticons
Tangram App Lock
Desire Translate
Meticulous Scanner
Of course, the recommendation for Android users is to check if they have any of these apps installed on their smartphone and delete them immediately, since the fact that they are deleted from the Google Play Store does not imply automatic uninstallation from the computers where they were downloaded.
Original post from Microsoft News\Entrepreneur
Frankenstein Computers has been taking care of our happy clients since 1999. We specialize in affordable IT Support, Cybersecurity Services, IT Services, IT Security, Office 365, Cloud, VOIP Services, SPAM, Wireless, Network Monitoring Services, Custom Gaming PC, MAC repair, PC Repair In Austin, Virus Removal, remote support, web design, on site support and much more. Give us a call for remote support or drop in to drop off. Check out what our clients are saying about us on Yelp!