New Android Trojan downloads paid apps without user consent

Malware attacks and other security breaches come and go. Some destructive and do varying degrees of damage to the infected, others are just annoying and can easily be thwarted with an antimalware / antivirus bug spray. And on the mobile space, Android gets its own share of intrusions, maybe even more than the other mobile operating systems given its legendary fragmentation. The latest malware attack that’s gotten aboard the Google mobile platform was found recently in China, a Trojan seeping into Android smartphones and purchasing apps without user consent.

Dubbed the “MMarketPay” by mobile security company TrustGo, the new intrusion was originally spotted on nine app stores on Chinese shores last week, and is now lording over 100,000 mobile devices there.

Like all Trojans, it works like a sneaky bastard; much like that cute pup you brought home only to find it amid your shattered vases, shredded pillows, and severely gnawed expensive loafers the next day. Infection starts when the user downloads a seemingly innocent but infected app from any of the nine app stores. And once MMarketPay makes it into a device, it’ll begin hooking up with Mobile Market, an app store hosted by the country’s largest mobile providers, China Mobile.

So devious is the Trojan that it can even bypass the SMS permission-based security system by intercepting the message from being sent to the user. And if the transaction requires CAPTCHA verification, MMarketPay comes fully prepared, sending the image to some remote server for analysis. Finally, it begins downloading apps and paid video content without letting the user know until all the charges show up on the next bill. That’s sure to ruin anyone’s weekend.

Thankfully, the Trojan has yet to crossover to local shores as the Google Play Store has pretty tight layers of security. So if you download your apps solely from there, then you should be safe. Otherwise, it’ll highly advised to download only from trusted app stores, give your intended download’s app developer a background check, and install a mobile security app. This means no more Torrenting of APKs of paid games.