Security firm Check Point on Thursday, May 25, unearthed a number of Android applications that infected devices with malicious ad-click software.
Among such apps, one had been available directly through Google's Play Store for over a year until recently.
How widespread the malware has yet to be determined, but the firm claims that it has managed to reach as many as 36.5 million Android devices, the most distributed malware yet found right inside Google Play.
Judy Malware: How It Works
The apps were often masked under the "Judy" brand, many of them being cooking or fashion games. Judy is borrowed from the name of the malware itself, for good measure. The apps' malicious behavior went largely unnoticed because its malware payload was siphoned from a non-Google server upon being installed on devices, according to Check Point. Once the code has penetrated the infected device, it would begin clicking on Google ads, which in turn would generate ad revenue toward the malware's perpetrator. This was how Judy was able to bypass Bounce, Google Play's protection system.
Judy Malware: Who's Responsible?
The trove of malicious apps was created by a Korean company named Kiniwini, registered in the Play Store as ENISTUDIO corp. The developer publishes apps for both iOS and Android platforms.
How To Keep Your Android Device Safe From Malware
One risk associated with an open software such as Android is its vulnerability to malicious software. So here are tips to keep an Android device safe from malware, and by extension, how to be avoid viruses when online.
• Check reviews: Even if the app you're downloading comes from a legitimate store, always check user reviews for potential red flags. Most likely, other users have already spotted it if there are any.
• Keep your system updated: Always make sure that the Android device is running the most recent operating system and security patch.
• Use a VPN: When connected to a public network, make sure that you're using a VPN, just in case any malicious perpetrator tries to infect your device via the unsecured network.
• Use an antivirus program: Try to find a good antivirus app. Some are free and some offer yearly subscription rates that sometimes include protection for multiple devices.
• Choose a strong password: Chances are passwords such as "12345678" and "password" won't be as strong as something more personal, specific, and cannot be guessed. As much as possible, include as many vague symbols and characters for optimum safety. Just be sure to actually remember it, of course.
Check out our article for more tips on keeping your Android device safe.
Play Store Malware Infestations
Judy isn't the first malware to infiltrate the Play Store — it's not the first time a malicious software bypassed Google's security check, and it's also not the most damaging, for that matter. By the looks of things, Judy-branded apps simply wanted a consistent fraudulent ad revenue stream, since Check Point wasn't able to find evidence that private data was compromised among infected Android devices.
But the fact that Judy was able to hide itself under seemingly benign apps that went undetected for such a long time might stand as a warning that Android is a less secure operating system than, say, iOS. This is a popular assumption, in fact, one that's been going on for quite some time.
If you have any thoughts about Judy, or if you think you've been infected by it, feel free to sound off in the comments section below!
