New Variant of Infamous Android Joker Malware Bypasses Google Play Security to Attack Users

The Joker malware detected in early June 2019, it employs several tactics to bypass GooglePlay protection and to perform several malicious activities.

The malware used to hide inside different apps and once users downloaded to the phone they got infected with the Joker malware.

It aims to steal money from the user by signing for paid subscriptions, it interacts with the user’s SMS messages, contact lists, and other data from the device.

Earlier it was observed that Joker malware hidden with 24 apps different apps, all the apps have been reported to Google and removed from the store.

New Joker variant

Check Point researchers discovered a new variant of Joker Dropper and Premium Dialer spyware in Google Play hidden with 11 apps that removed from Google Play on April 30, 2020.

The updated version of Joker malware hides behind look like legitimate apps and downloads additional malware on the device.

“This time, however, the malicious actor behind Joker adopted an old technique from the conventional PC threat landscape and used it in the mobile app world to avoid detection by Google.”

The Joker malware utilizes Notification Listener service and a dynamic dex file loaded from the C&C server to subscribe to users for the premium services.

The new malware also checks the malicious flow every time by creating a new object that communicates with the C&C to check if the campaign was still active.

To minimize the Joker’s fingerprint, the malicious actors loaded the dynamic dex file “from sight while still ensuring it can load – a technique which is well-known to developers of malware for Windows PCs.”

The new variant of the malware hides it’s malicious dex file within the application as Base64 encoded strings, ready to be decoded and loaded.

The new variant also contains the code of the original Joker malware in its main dex file “the registration of the NotificationListener service, subscribing the user to premium services, and more.”

Here you can find the package names of 11 malicious applications that hide a new variant of Joker.

If you have installed any of the malicious apps, it is recommended to remove them immediately and to check your mobile and credit-card bills for unwanted charges.