Cybersecurity researchers discovered another instance of Android malware hidden under the guise of legitimate applications to stealthily subscribe unsuspecting users for premium services without their knowledge.

According to a report by Check Point, the malware – called Joker (or Bread) has found another way to bypass Google’s Play Store protections and obfuscate the malicious DEX executable inside the application as Base64 encoded strings, which are then decoded and loaded on the compromised device.

The Joker malware is tricky to detect, despite Google’s investment in adding Play Store protections. Although Google has removed the malicious apps from the Play Store, we can fully expect Joker to adapt again.

Background of Joker Malware

Joker was first discovered in 2017 and is one of the most prevalent kinds of Android malware, notorious for perpetrating billing fraud and its spyware capabilities, including stealing SMS messages, contact lists, and device information.

To mask their true nature, the malware authors behind the large-scale operation have resorted to a variety of methods such as encryption to hide strings from analysis engines, fake reviews to lure users into downloading the apps, and a technique called versioning, which refers to uploading a clean version of the app to the Play Store to build trust among users and then sneakily adding malicious code at a later stage via app updates.

What does the malware do?

The new variant spotted by Check Point has the same goal but goes about it by leveraging the app’s manifest file, which it uses to load a Base64 encoded DEX file.

This variant comes equipped with a new feature that allows the threat actor to remotely issue a “false” status code from a C&C server under their control to suspend the malicious activity.

If anything, the latest Joker scheme represents less of a critical threat than it does a reminder of how Android malware is continually evolving and has to be protected continuously.

As the Play Store has introduced new policies and Google Play Protect has scaled defenses, Bread apps were forced to continually iterate to search for gaps. They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected.

As of January 2020, Google has removed more than 1,700 apps submitted to the Play Store over the past three years that had been infected with the malware.

Recommendations

It is recommended to consider the following best practices:

• Do not install any of the infected apps (check the hash list of the apps here) on your phone.
• If any of the apps in the list have been installed on your phone then check your mobile and transaction history to see if there are any suspicious payments that you don’t recognize.
• Make sure to carefully scrutinize your permissions for every app installed on your Android device.