Malware Alert: 60 Google apps with over 100 million downloads have been infected. Delete any of these apps you downloaded from the Play Store.

McAfee researchers have released a list of apps infected with Goldson malware, with over 60 such apps found on the Google Play Store. These apps threaten sensitive information such as contacts, call logs, and location data, which can be used to send spam messages and make unauthorized purchases. McAfee has reported this to Google, and the apps have been removed from the Play Store for further downloading and installation.

However, these apps have already been downloaded on over 100 million smartphones. Users are advised to uninstall these apps if downloaded on their Android smartphones. Most of these apps target the South Korean Google Play Store, and this serves as a reminder to all developers to be careful about the third-party libraries they use in their apps, as some may contain malware.

Uninstall these infected apps from your Android device.

Developers should avoid using malware-infected third-party libraries. Goldson malware is part of a third-party library that developers may have used unknowingly. MMRT has said that this was not made by developers by choice, but it is unclear whether they knowingly or unknowingly injected Goldson into their apps.

To prevent such incidents, developers should:

• Use third-party libraries from trusted sources.
• Check the code before implementing it.
• Keep third-party libraries up-to-date.
• Read reviews of those libraries before using them.

Some apps have already started receiving security patches, and developers have removed the malware from some apps, but not all of them. However, Goldoson-infected apps still exist in third-party app stores and could harbor malicious libraries. The risk of this happening is high.

What Data Does Goldoson Malware Collect?

• Device information includes the device model, serial number, and IMEI number. However, the amount of data Goldonson Malware collects depends on the permissions granted by users. Devices running on Android 11 or higher have better protection against this random data collection.
• Location data
• MAC address of Bluetooth and Wi-Fi nearby
• Contact information
• Call logs
• SMS messages
• Browsing history
• Credit card information
• Banking information

Any other sensitive data stored on the device can be used by cybercriminals to extract Basic Service Set Identifiers (BSSIDs) and Received Signal Strength Indicators (RSSIs). Your BSSIDs can connect to your Wi-Fi network and triangulate your location. Goldson malware can determine your location more accurately than GPS, especially indoors. They can also try to hack into your network and steal more personal information.

Goldson Malware

This malware first collects all the installed apps and synced devices via your device’s Bluetooth, GPS, or Wi-Fi. To stay informed about you, it re-collects data every two days. It can also perform ad fraud by clicking on ads in the background without users’ consent. Android 11 or higher devices are more insulated from this threat, but this needs to be confirmed because less than 10% of the apps with Goldoson have ‘QUERY_ALL_PACKAGES,’ allowing access to app information and sensitive data.

Once users download and install the launch that contains Goldoson, the library registers the device and receives a configuration from the remote server whose domain is obfuscated. These updated configurations contain the parameters for data-stealing and ad-clicking functions that Goldson should run on the infected device and how often.

Goldson Malware can also perform other malicious activities, such as installing other malware on the device, stealing files from the device, disrupting the device’s operations, and taking control of the device. As mentioned above, it is set to be active every two days, sending data to the C2 service, a command and control server used by attackers to control the infected device. They can send commands to the infected device, receive data from the infected device, and update the malware on the infected device.

These apps have been downloaded millions of times from the Google Play Store. Check out these lists:

Even after uninstalling these apps, you can check the device for other signs of malware infection, like the device heating up, battery drain, and unusually high internet data usage, even when you are not using your device. To check for and remove malicious apps from your device, navigate to Device Settings > Security or App Protection. From there, look for apps you don’t recognize or need to remember to install. If you find any suspicious apps, then uninstall them instantly. You can also use a security app to scan your device for malware.

Stay protected. Use a strong password for your Wi-Fi network, keep your network up-to-date, use a firewall to protect your device from unauthorized access, be aware of what apps you install, and most importantly, use a strong password and 2FA authentication for your online accounts.

You can stay protected by updating your device with the latest security patch. These updates often include security patches that can help protect your device from malware. Install apps from trusted sources like the Google Play Store. Be aware when granting app permissions. Use a security app to scan for malware. If your device gets infected with malware, contact your manufacturer or a security expert.