More than 190 apps have been discovered on the Google Play Store that are infected with this Trojan, according to Kaspersky. These infected apps have 4.8 million downloads, according to the research, although experts think the number may be greater.
Cybersecurity specialists have issued a warning about a new type of malware that might drain users’ bank accounts by secretly enrolling them up for subscription services.
In its blog, the cybersecurity company Kaspersky went deeper into the Harly malware, which was named after the sidekick of a well-known comic book villain. It imitates genuine applications and is comparable to the Jocker Trojan.
More than 190 apps have been discovered on the Google Play Store that are infected with this Trojan, according to Kaspersky. These infected apps have 4.8 million downloads, according to the research, although experts think the number may be greater.
How do these Trojans operate then? They obtain common apps from Google Play, add dangerous code to them, and then upload the modified apps to Google Play with a new name. These applications might continue to have the same features as those provided in the description, avoiding suspicion.
According to Kaspersky, Harly Trojans use several techniques to decrypt and launch the entire payload from within the app. When the malicious program is downloading, The Harly begins to gather data about the user’s device. The user’s phone then switches to the mobile network, and the Trojan then requests that the C&C server configure the list of required subscriptions.
The blog claims that this Harly Trojan functions with Thai operators. It verifies that the mobile network codes, which are the network operators’ distinctive identifiers, are Thai.
The Trojan then accesses the subscription address in a hidden window, inputs the user’s phone number via inserting JS scripts, hits the necessary buttons, and enters the text message confirmation code. Unaware that they are receiving a premium membership, the user.
In addition to processes protected by text message codes, the Harly Trojan can also subscribe to processes protected by phone calls. Here, it calls a particular number to verify the subscription.
Before installing an app, you should read user reviews and verify its Google Play rating to protect yourself from such Trojans. Installing internet security software on your desktop or laptop is also advised.
