30,000 blacklisted apps hosted on the Google Play Store report finds

RiskIQ has released its Mobile Threat Landscape Q2 2018 Report, which analyzed 120 mobile app stores and more than two billion daily scanned resources. The findings show a spike in blacklisted apps headlined by Trojans and Adware, as well as a fascinating shift in tactics by mobile threat actors.

For the second year in a row, RiskIQ observed a sharp increase in blacklisted apps between May and June. Although this spike was less dramatic in 2018 than in 2017 - an increase of nearly 30,000 apps in 2017 versus 12,000 in 2018 - it continues a trend of accelerated Q2 blacklistings following lows in January and February.

In total, RiskIQ observed 52,885 Blacklisted apps in Q2, which was 4% of all apps seen by the company and a 2% increase over Q1. The Google Play store made up a large chunk of this number, hosting 28,533 blacklisted apps, which is over 20,000 more blacklisted apps than Q1 2018 and 10,000 more than what RiskIQ observed in any quarter since Q1 2017.

RiskIQ also observed 11,288 blacklisted Feral apps (apps seen outside of any app store), 4,750 blacklistings in the 9Apps third-party store, and 2,985 blacklistings in the AndroidAPKDescargar third-party store.

Q2 marked a shift in tactics for threat actors using the mobile vector including:

Attacks on myetherwallet.net: By copying the MyEtherWallet website and adding malicious scripts, threat actors spun up a phishing page that looked and acted like the official MyEtherWallet site, but sent authentication data to C2 servers when the victim enters their password to access/decrypt their wallet. This attack highlighted the trend of threat actors targeting the cryptocurrency landscape.

Run for your (Battery) life: RiskIQ spotted a mobile scam page claiming to detect and resolve battery life issues that directed the victim to a malicious “battery life” app hosted in the Google Play store under the name 'Advanced Battery Saver.' The app claimed very excessive permissions including the ability to read sensitive log data, receive text messages (SMS), receive data from Internet, and modify system settings. It also stole IMEI data, phone numbers, location data, and included an ad-clicker as a revenue generator for the app author.