The affected applications have been downloaded up to 9 million times, combined, and Google has only just shut down the developer accounts and the applications thanks to Lookout's warning.
In their report, firm describes the malware: "BadNews masquerades as an innocent, if somewhat aggressive advertising network. This is one of the first times that we've seen a malicious distribution network clearly posing as an ad network. Because it's challenging to get malicious bad code into Google play, the authors of Badnews created a malicious advertising network, as a front, that would push malware out to infected devices at a later date in order to pass the app scrutiny. Badnews has the ability to send fake news messages, prompt users to install applications and sends sensitive information such as the phone number and device ID to its Command and Control (C&C) server. BadNews uses its ability to display fake news messages in order to push out other types of monetization malware and promote affiliated apps."
BadNews has been seen pushing "AlphaSMS," a premium rate SMS fraud malware that affects users in the Russian Federation and neighboring countries such as the Ukraine, Belarus, Armenia and Kazakhstan.
You can read more here: Lookout
Written by: Andre Yoskowitz @ 20 Apr 2013 22:41
