New Android Malware Strikes Millions of Devices via Google Play Store

Legitimate applications on Google Play are being exploited to disseminate a new variant of Necro Android malware. This malware has the ability to download adware, secretly enrolling users in subscriptions and utilizing their devices to direct malicious traffic. According to a report from Bleeping Computer, it was spread through advertising development kits integrated into legitimate apps, including well-known titles like Spotify, WhatsApp, and Minecraft.

The malware has reportedly infected approximately 11 million devices via Google Play.

Originally identified by researchers at Kaspersky, the malware conceals its harmful activities while downloading a payload onto affected devices. This payload camouflages itself as seemingly harmless PNG images, which are then utilized for malicious purposes.

Beyond the Play Store, the malware is primarily propagated through modified versions of popular apps that claim to offer free subscriptions or enhanced user experiences. These modified applications are often distributed via unofficial websites.

Among the infected modifications are WhatsApp mods that promise improved privacy controls and expanded file-sharing capabilities, as well as a Spotify mod that offers free access to an ad-free premium service.

Researchers have also discovered malware-infected mods of popular online games, including versions of Minecraft, Stumble Guys, Car Parking, and Melon Sandbox. Because unofficial Android app stores do not report download statistics, the total number of infected devices remains uncertain.