Kaspersky reports Necro Trojan sneaks into Google Play with up to 11 million victims

September 27, 2024

In late August 2024, Kaspersky experts identified a new version of the Necro Trojan that had infiltrated several popular applications on Google Play and modified applications on unofficial platforms, including Spotify, WhatsApp and Minecraft. Necro is an Android downloader that downloads and runs other malicious components on infected devices based on commands issued by the Trojan’s creators. Kaspersky’s solutions recorded* Necro attacks targeting users in Russia, Brazil, Vietnam, Ecuador, and Mexico as part of this malicious campaign.

Capabilities of the Necro Trojan
The variant of Necro discovered by Kaspersky experts can download modules onto infected smartphones that display ads in invisible windows and click on them, download executable files, install third-party applications, and open arbitrary links in invisible WebView windows to execute JavaScript code. Based on its technical characteristics, the Trojan is also likely capable of subscribing users to paid services. Additionally, the downloaded modules allow attackers to redirect internet traffic through the victim’s device. This enables cybercriminals to visit prohibited or desired resources using the victim’s device, potentially utilizing it as part of a proxy botnet.

Infected Apps on Unofficial Platforms
The first discovery of Necro by company’s experts was in a modified version of Spotify Plus. The creators of the app claimed that it was safe for devices and offered additional features not found in the official music streaming app. Subsequently, experts also found a modified version of WhatsApp containing the Necro downloader, followed by infected versions of popular games, including Minecraft, Stumble Guys, and Car Parking Multiplayer. Necro was embedded into these applications via an unverified ad module.

Infected Apps on Google Play
The Necro campaign extended beyond third-party platforms and was also discovered on Google Play. The malicious downloader was found in the Wuta Camera app and Max Browser. According to Google Play statistics, the combined downloads of these apps exceeded 11 million. On this platform, Necro was also distributed via an unverified ad module. Following Kaspersky Lab’s report to Google, the malicious code was removed from Wuta Camera, and Max Browser was taken down from the store. However, users still risk encountering Necro on unofficial platforms.

“Users often download unofficial, modified apps to bypass restrictions in official applications or to access additional free features. Cybercriminals exploit this behavior, spreading malware with these apps as there is no moderation on third-party platforms,” comments Dmitry Kalinin, cybersecurity expert at Kaspersky. “It is also noteworthy that the version of Necro embedded in these applications used steganography techniques, hiding its payload within images to remain undetected – a very rare method for mobile malware.”

Kaspersky’s security solutions protect against Necro and detect the downloader as Trojan-Downloader.AndroidOS.Necro.f and Trojan-Downloader.AndroidOS.Necro.h, with the malicious components identified as Trojan.AndroidOS.Necro.

To learn more about Necro Trojan, visit Securelist.com.

To protect against this and other Android cyber threats, Kaspersky experts also recommend:

• Download apps only from official sources;
• Regularly update their operating system and installed applications;
• Use a reliable security solution from a trusted manufacturer whose products are verified by independent test labs, such as Kaspersky Premium.

** Data based on anonymized statistics of Kaspersky solutions for August 26 – September 15, 2024.