Security firm Lookout, Inc. has uncovered a bit of Russian malware called BadNews in 32 separate apps across four different developer accounts in Google Play.


Picture source: SiliconAngle

It seems the malware mostly affected Android owners in Russia, Ukraine, Belarus and other countries in Eastern Europe, but according to Google Play statistics, the combined affected applications have been downloaded between 2,000,000 – 9,000,000 times.

Lookout says that BadNews masquerades as an innocent, if somewhat aggressive advertising network. However, it has the ability to send fake news messages, prompt users to install applications and sends sensitive information such as the phone number and device ID to its Command and Control (C&C) server. BadNews uses its ability to display fake news messages in order to push out other types of monetization malware and promote affiliated apps.

This masquerade ended according to the BBC when apps seeded with BadNews got a prompt from one of three command and control servers, then it started pushing out and installing a more malicious programme called AlphaSMS. This steals credit on infected phones by sending text messages to premium rate numbers.

Users were tricked into installing AlphaSMS as it was labelled as an essential update for either Skype or Russian social network Vkontakte.

Google Play suspended those accounts and removed the affected apps from the store.