Apps infected with Joker malware have been downloaded more than 500,000 times from the Huawei AppGallery. The apps have since been removed from that app store, but users have to get them from their device themselves.
Antivirus company Doctor Web writes in a report that it has found a dozen apps on Huawei’s AppGallery that are a vehicle for Joker malware. These include a messaging service, a puzzle game and a camera app.
Those apps largely do what they are supposed to do, but the device users also subscribe to paying mobile services. According to the report, the apps also request access to notifications to fool users for longer. With that permission, the software could intercept any confirmation text messages sent when you subscribe to a paid service.
According to Doctor Web, the malware can subscribe users to five of those services. Of the infected services, eight are from the developer Shanxi Kuailaipai Network Technology Co. These are Fun Color: Color Touch Effects, All-in-One Messenger, New 2021 Keyboard, Happy Tapping, Happy Color, Funney Meme Emoji, BeautyPlus Camera and Color RollingIcon. Two other apps, Super Keyboard and Camera MX, also contain malware.
More than 538,000 Huawei users downloaded these ten apps, the report said. The researchers have submitted their findings to Huawei, and the apps have now been removed from the AppGallery. However, users can still remove them from their phones themselves.
The malware issue is identified as Joker. That is a piece of software that Android has been playing tricks on for four years now. The malware is particularly persistent because it is quite lucrative: the malware communicates with a server of the criminals and thus receives a series of tasks, including the registration of victims for paid services, without them even being aware of it.
Researchers see Joker as one of the most common threats on Android, and dozens of variants have been reported to have been found. In his report, Doctor Web lists and the Huawei apps, a series of apps that can be found in the ‘regular’ Android Play Store.