Sourced from: Kaspersky.

What are fake apps?

Fake apps are apps created by cybercriminals to cause harm to users and their devices. They are designed to resemble legitimate apps but instead carry out malicious activities. These activities include monitoring your activity, installing malware, showing annoying ads, or stealing your personal information.

How do fake apps work?

Fake apps can be distributed in various ways. They can be hosted on third-party app stores or fake app stores. Cybercriminals can even use official app stores to distribute fake apps, despite the security measures in place.

A cybercriminal can register themselves as a developer on any app store, download a legitimate app, and rewrite it using malicious code. Then, they can upload their fake app to the app store.

While Google says it reviews all apps and developers, it is still possible for malicious apps to appear in the Google Play Store. Google constantly removes fake Android apps from the Play Store, including fake antivirus, browsers, and games. While Apple’s App Store only allows vetted applications, it is reported to sometimes still host fake apps. From the point of view of the attackers, mobile devices are ideal targets – they travel almost everywhere with their owners, contain details about their private lives and the infections are very difficult to prevent or detect.

Sometimes, fake apps are circulated through social engineering campaigns. For example, scammers may use emails or SMS messages that appear to be from your bank, credit card company, or other brands to trick people into downloading applications that will compromise their data. Sometimes fake apps may pose as a fake Android update or a security update, but clicking on the links may lead to your information being stolen.

There are many third-party app stores – i.e., non-official stores. These have fallen victim to a higher concentration of malicious apps than Google Play or Apple’s App Store.

Types of fake apps

Fake apps fall into two broad categories:

Counterfeits:

These are fake apps that imitate a real one. They may feature a logo, screenshots, and artwork similar to the app they are trying to copy. The description may be stuffed with keywords that the average user might use when searching for the genuine version of the app. The name may sound similar to the original but contain a changed letter or two.

Repackages:

Sometimes, developers make their apps open source – which means the source code is accessible and can be modified by anyone. Taking an open-source app and repackaging it – for example, by adding ads – is much easier than developing your own app. It isn’t illegal to do so – if an app is open source, then people are free to modify it – but the addition of ads is annoying to the end-user. These types of apps can be challenging to spot.

Fake app threats

While some may be harmless, fake apps are often dangerous apps. Fake app examples include:

Ad bots:

Repacked apps often come with ads that the legitimate free version doesn’t have, and your phone might start showing unexpected ads as well.

Billing fraud:

Billing fraud occurs when fake apps automatically charge purchases to your phone bill without your consent. These could include making collect phone calls, sending premium SMS messages, or making purchases in an app store.

Botnet:

The dangerous app covertly uses the smartphone as a part of a DDoS (distributed denial of service) attack, mining cryptocurrency, or sending spam.

Hostile content:

This can take various forms, but a typical example would be a fake app that includes inappropriate content, such as hate speech or violence.

Hostile downloaders:

These are dangerous apps that don’t contain malicious code but initiate the download of other harmful applications onto your device without your consent.

Phishing:

A fake app may direct you to input your login credentials or go to a website to do that (or infect you via that website). Criminals then steal your login information to use for malicious purposes.

Privilege escalation:

Privilege escalation apps aim to bypass the number of privileges allowed on your device. This results in access to elevated privileges or the disabling of core security functions.

Ransomware:

Some fake apps are used to infect your device with ransomware. As a result, your data becomes encrypted and unreadable. To re-gain access to your data, hackers will demand money from you.

Rooting:

Rooting apps contain code that roots the device, typically known as jailbreaking. Not all rooting apps are harmful, and legitimate apps can perform rooting—but genuine apps require user consent and don’t carry out harmful actions against your device.

Spam:

Spam apps contain code designed to send unsolicited messages to your contacts or involve your device in an email spam campaign.

Spyware:

Spyware apps send personal data to third parties without your consent. Exploited data may include text messages, call logs, contact lists, email records, photos, browser history, your GPS location or data from other apps on your device.

Trojan:

Trojan apps are those that seem harmless, such as a simple game, but secretly perform undesirable actions in the background. They include a benign component that allows the app to function as intended and a hidden harmful component, such as sending premium SMS messages from your device without your knowledge.