Android App Security · Spotting Bad Apps · Lesson 1 of 5

How Malware Gets In

Fake apps, sneaky updates and texted links: the main roads onto a phone.

Fakes, copies and texted links

Malware is any software built to harm you or the phone: stealing logins, sending paid texts, spying, or locking files for ransom. Almost none of it breaks in by itself. Instead, it gets you to install it.

The oldest trick is the fake app: a file that borrows the name and icon of something popular, like a delivery tracker, a video player or a banking app. A close cousin is the repackaged app. Someone takes a real APK, unpacks it, adds their own code, and packs it back up. It looks and works like the original, with something extra hidden inside.

You saw in Mobile Fundamentals that every APK is signed. A repackager can't use the real developer's private key, so the copy carries a different signature. Android won't install it as an update over the genuine app, which is why these copies are usually spread as new downloads outside the Play Store.

To get you there, attackers build fake app pages: websites dressed up to look like an app store or a company's download page, with a big Download button that hands you an APK. Links to them arrive in ads, social media posts, and especially text messages.

A well documented example is FluBot. In 2021 the UK's National Cyber Security Centre warned about texts claiming a missed parcel delivery. The link led to a fake delivery site that walked people through allowing installs from unknown sources, then installed a "tracking" app. Once running, it could read and send texts, show fake screens over other apps, and grab contacts. It then texted the same lure to those contacts, which is how it spread so quickly.

Notice what the victims had to do: tap a link, turn on a setting, and approve an install. Every step was a chance to stop.

Droppers and the slow-burn update

The Play Store reviews apps before they go live, and Google Play Protect scans them too. So attackers who want to reach a big audience don't upload obvious malware. They upload a dropper: an app that looks harmless, often is harmless at first, and later downloads and installs the real malicious part, called the payload.

Google's own security team described one long running family, Bread (also called Joker), in January 2020. Its apps made money by signing people up for paid services billed to their phone account. One of its tricks Google called versioning: publish a clean version that passes review, then add the malicious code later through an update. Google said Play Protect had detected and removed about 1,700 unique Bread apps from the store before anyone downloaded them, which shows how persistent these groups are.

In November 2021 the security firm ThreatFabric reported droppers on Google Play posing as QR code scanners, PDF scanners, a crypto tracker and a fitness app. They actually worked, which earned good reviews. Some launched with no bad code at all. Later, users were told to install an "update" to keep using the app, and that update was a banking trojan such as Anatsa. The attackers often switched the payload on only for phones in the countries they were targeting, which made the apps harder for researchers to catch.

The pattern to remember: a tool app with a simple job, from a developer you've never heard of, that suddenly asks you to install an add-on, a plugin or an update from inside the app rather than through the store. Real Play Store apps update through the Play Store. An app asking for permission to install other apps is a strong warning sign.

Play Protect also checks apps from outside Play when you install them and scans the phone from time to time. It helps a lot, but it can't catch everything on day one.