Hundreds of Android Apps on Google Play Store Infected by Xavier Malware

Hundreds of Android Apps on Google Play Store Infected by Xavier Malware

You might have heard researchers urging Android users not to download apps from a third party store since a lot of them contain malware. Now, things have changed as hackers and cyber criminals are bypassing Google’s security implementation on Play Store and uploading apps infected with malware.

The IT security researchers at Trend Mirco have discovered that over 800 Android apps on Google Play store contain a malware called Xavier that is silently stealing personal and financial data of users. The infected apps belong to categories like photo manipulators, utilities, ringtone chargers, anti-virus, volume booster, speed booster, video converter, call recorder, and wallpaper apps downloaded millions of times by users around the world.

The majority of downloads came from countries like Indonesia, Philippines, and Vietnam while some of the downloads attempts were from European countries and the United States.

Features of Xavier Info-Stealing Malware

 The previous variant of Xavier Ad library was a simple adware with an ability to install other APKs silently on the targeted devices, but in the latest release, the malware author has replaced those features with more sophisticated ones, including:

•     Evade Detection: Xavier is smart enough to escape from being analyzed, from both static and dynamic malware analysis, by checking if it is being running in a controlled environment (Emulator), and using data and communication encryptions.

•     Remote Code Execution: The malware has been designed to download codes from a remote Command & Control (C&C) server, allowing hackers to remotely execute any malicious code on the targeted device.

•     Info-Stealing Module: Xavier is configured to steal devices and user related information, which includes user’ email address, Device id, model, OS version, country, manufacturer, sim card operator, resolution, and Installed apps.

 Here is a list of 75 infected apps list that Google has already removed from its Play Store, and if you have installed any of these apps on your device, you are advised to remove it immediately

Android malware continues to evolve with more sophisticated and never-seen-before capabilities with every passing day. Just last week, we saw first Android malware with code injecting capabilities making rounds on Google Play Store.

How to Protect Yourself

The easiest way to prevent yourself from being targeted by a clever malware like Xavier, always beware of fishy applications, even when downloading them from official Play Store and try to stick to the trusted brands only.

Moreover, always look at the reviews below left by other users who have downloaded the app and verify app permissions before installing any app and grant those permissions that have are relevant for the app's purpose.

Last but not the least, you are strongly advised to always keep a good antivirus application on your device that can detect and block such malware before they can infect your device, and keep your device and apps up-to-date.