It is not new for an app available on the Google Play Store to be caught infecting millions of Android smartphones across the globe. Well, the latest one to join the list of malware apps is a popular barcode scanner app, simply called “Barcode Scanner.”
According to a new report by Malwarebytes, the hugely popular Barcode Scanner app, which is listed on the Google Play Store with over 10 million downloads, has infected Android devices across the globe with malware.
Good thing is that Google was prompt in taking note of this report by Malwarebytes and the app is now removed from the Play Store. But we believe it is still available on many of the infected devices.
Just to give you an overview, the Barcode Scanner app allows users to use the camera on their smartphones to scan the barcode or QR code on any product.
However, security researchers at Malwarebytes discovered the app is infecting Android devices with malware after the recent December update. Apparently, the malicious code was not present in the previous version of the app.
It is only after the recent December 2020 update, the Barcode Scanner app was detected of injecting malware. Another interesting discovery by Malwarebytes suggests the app used “heavy obfuscation” to avoid getting detected.
The security firm discovered a trojan, Android/Trojan.HiddenAds.AdQR, which was used to avoid Google security policies.
The app was signed by the same digital certificate as previous versions
The blog post further reveals that the Barcode Scanner app was coming from the same developer, LavaBird LTD. Moreover, it was signed by the same digital certificate as previous versions.
Several apps present in the Google Play Store include advertising. This is done by including an SDK in the app’s code. Free apps will have this SDK included, while the Premium apps do not have this SDK.
As for Barcode Scanner, right after installing this app, it started redirecting users to various malicious websites with no user input. Although this app plagued with malware is already gone from the Play Store, it still remains on devices.
So, it is advised to remove the Barcode Scanner installed on your Android phone. Besides, you should also install a malware scanner like Malwarebytes to remove such apps. If the app is not uninstalled, it will continue to show you shady ads and webpages.
One thing we can deduce from this situation is that it’s not the app developers that are the culprits here. It is the SDK company that has infected the app with malicious SDK.