August 17, 2018 By Wylie Wong 2 min read

Google pulled 145 Android apps from its Play Store after researchers discovered they were infected with malicious Windows-executable files.

Palo Alto Networks reported on July 30 that infected Android Package Kit (APK) files on the 145 mobile apps do not pose a threat to Android devices because the embedded files run only on Windows machines. However, the malicious code could still endanger Windows devices and the software ecosystem as a whole.

“This type of infection is a threat to the software supply chain, as compromising software developers has proven to be an effective tactic for wide scale attacks,” Palo Alto Networks’ Unit 42 threat intelligence team wrote in its blog.

Security Risks From Infected Apps

Most of the infected Android apps were published on Google Play between October and November 2017. Several had more than 1,000 installations and four-star ratings, according to the report. Among those infected were “Learn to Draw Clothing,” “Gymnastics Training Tutorial” and a bike app called “Modification Trail.”

The researchers speculated that the Android apps were likely infected with Windows malware because the developers built the apps on compromised Windows machines.

Among the infected Android apps, Palo Alto Networks found that APK files — a file format for applications used in the Android operating system — may contain multiple malicious portable executable (PE) files. One malicious PE file found in most of the infected apps was a keylogger that could capture keystrokes and steal users’ sensitive information, such as credit card numbers and passwords.

The malware can spread if an infected APK file is unpacked on a Windows machine and the PE files are accidentally executed, the report noted. It can become even more difficult to contain if the developers also issue Windows-based software, or if they are infected with malicious files running on Android platforms.

How Can Companies Improve Mobile App Security?

Although Google deleted the infected apps from its Play Store, some enterprise endpoint users may have already downloaded them. To improve mobile app security, IBM Security experts advise organizations to patch their operating systems and applications with the latest fixes and update their antivirus software as newer versions become available.

In the case of the infected Android apps, security teams will have to search for existing signs of indicators of compromise (IoCs). A full list of the IoCs associated with the infected apps is available on the IBM X-Force Exchange. IBM Security experts also recommend blocking all URL and IP-based IoCs with their firewalls, intrusion detection systems (IDSs), web gateways, routers and other perimeter-based devices.

Source: Palo Alto Networks

More from

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication.Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future success…

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today