Joker Malware Apps Once Again Bypass Google’s Security to Spread via Play Store

Cybersecurity researchers took the wraps off yet another instance of Android malware hidden under the guise of legitimate applications to stealthily subscribe unsuspecting users for premium services without their knowledge.

In a report published by Check Point research today, the malware — infamously called Joker (or Bread) — has found another trick to bypass Google’s Play Store protections: obfuscate the malicious DEX executable inside the application as Base64 encoded strings, which are then decoded and loaded on the compromised device.

Following responsible disclosure by Check Point researchers, the 11 apps (list and hashes here) in question were removed by Google from the Play Store on April 30, 2020.

“The Joker malware is tricky to detect, despite Google’s investment in adding Play Store protections,” said Check Point‘s Aviran Hazum, who identified the new modus operandi of Joker malware. “Although Google removed the malicious apps from the Play Store, we can fully expect Joker to adapt again.”

Joker: A Large-Scale Billing Fraud Family

First discovered in 2017, Joker is one of the most prevalent kinds of Android malware, notorious for perpetrating billing fraud and its spyware capabilities, including stealing SMS messages, contact lists, and device information.

Campaigns involving Joker gained more foothold last year, with a number of malware-infected Android apps uncovered by CSIS Security Group, Trend Micro, Dr.Web, and Kaspersky, repeatedly finding unique ways to exploit gaps in Play Store security checks.

To mask their true nature, the malware authors behind the large-scale operation have resorted to a variety of methods — encryption to hide strings from analysis engines, fake reviews to lure users into downloading the apps, and a technique called versioning, which refers to uploading a clean version of the app to the Play Store to build trust among users and then sneakily adding malicious code at a later stage via app updates.

“As the Play Store has introduced new policies and Google Play Protect has scaled defenses, Bread apps were forced to continually iterate to search for gaps,” Android’s Security & Privacy Team said earlier this year. “They have at some point used just about every cloaking and obfuscation technique under the sun in an attempt to go undetected.”

As of January 2020, Google has removed more than 1,700 apps submitted to the Play Store over the past three years that had been infected with the malware.

Using Android Manifest to Hide Malicious DEX File