Virus alert: have you downloaded this application that hides spyware?
This shady activity was spotted and made public by ESET researcher Lukas Stefanko in a recent article. It is learned that more than 50,000 people had downloaded the application known as iRecorder – Screen Recorder. This banal application, designed to record the screen of a device, was put online on the Play Store on September 19, 2021. Since that date, everything was working normally, but an update in August 2022 changed the situation. …
ESET #malware researcher Lukas Stefanko revealed how an initially legitimate #Android app morphed into a malicious #trojan that could steal users’ files and record surrounding audio from the device’s microphone and then exfiltrate it.
Find out more in a video with @TonyAtESET pic.twitter.com/Ju0QrDN3Ro— ESET (@ESET) May 26, 2023
The RAT does not leave the ship!
This last update changed the nature of the application by “waking up” AhRat, a not cool RAT (Remote Access Trojan). ESET immediately notified Google of its findings and iRecorder has since been removed from Google Play. However, the modified application continues to pose a threat to those who have installed it on their smartphones, as it allows access to files and audio recordings invisibly. In short, you end up with a microphone in your pocket: the dream for the government!
The importance of a recent OS…
AhRat will therefore take care of recovering audio recordings and transferring them to the brigands’ server. ESET has not been able to say which hacker group is behind this app or how and why these records were processed. Note that devices with recent versions of the system (since Android 11) have not been worried by iRecorder since since 2020, Google has implemented several measures to combat this type of malicious action by now alerting the user when bizarre phenomena: suspicious data sharing, abusive authorization, etc. This is not the first time that malware has slipped through the cracks of Google’s surveillance systems. We remember in particular Soraka who “played dead” to avoid detection.
