Careful! If you have any of these apps on your Android phone, you could be at risk. Several applications, including photo and video editors, drawing tools, and wallpapers, have been found to be infected with Fleckpe, a malware that can compromise your security and privacy. Get to know the infected apps and fix it quickly.
Recently, a new type of rogue application has been discovered that, instead of installing malware or adware, instead subscribes users to premium paid services without their knowledge. This subscription Trojan, called Fleckpe by the Kaspersky security researchersis being spread via seemingly harmless apps like photo editors, wallpaper packs and other utilities for Android phones.
Although it is not the first time that this type of scam has been detected, the danger lies in the fact that users may not realize that their phone has been infected and that they are being subscribed to premium services. According to the Kaspersky report, Fleckpe has been active since last year and has already infected more than 620,000 devices. Will yours be among them?
Unauthorized premium subscriptions
When a user downloads an application infected with the Fleckpe Trojan, the Trojan runs a hidden payload that communicates with a server controlled by the cybercriminals behind the campaign. The Trojan collects user location information via their Mobile Country Code (MCC) and Mobile Network Code (MNC) and then opens a premium subscription page in an invisible browser.
The Trojan tries to register the user for a premium subscription, and if a confirmation code is required, the Trojan can obtain this code through the permissions that the infected apps requested to access the user’s notifications. In this way, the Trojan confirms the subscription without the user noticing. This entire process happens in the background without the user even suspecting that their device is infected.
It is important to note that Fleckpe-infected apps appear to work just fine to prevent the user from suspecting that there is something wrong with their device. However, in the background, the Trojan is performing these malicious activities to secretly subscribe to these paid services.
infected apps
The malicious apps mentioned below are no longer available on the Google Play Store. But, if you happen to have any of these apps installed on your mobile, you should manually remove it as soon as possible to avoid any risk or security threat they may pose. The list is the following:
- Beauty Slimming Photo Editor
- photo effects editor
- Gif Camera Editor Pro
- Photo Editor Toolbox
- Beauty Camera Plus Photo Editor
- Microclip Video Editor
- Camera Photos
- H4KS Wallpaper
- Draw Graffiti
- Night Cam Rea Pro
It is important to note that there may be errors in the names of the applications mentioned, since they have not provided the complete list from Kaspersky.
Avoid getting infected
Although not as harmful as spyware or data-stealing malware, subscription Trojans can lead to unauthorized charges, the collection of personal information, and be used as a gateway for more serious attacks. To avoid these risks, Android users are advised to only download apps from trusted sources and trusted developers and to pay attention to the permissions requested during installation.
Even if an app has a high rating and many downloads, it could still be malicious. That is why it is essential to avoid installing unnecessary applications. Also, it is recommended to avoid free apps as paid apps are much less likely to be scams.
To ensure additional protection, it is suggested to ensure that Google Play Protect is enabled on the mobile as it continually scans new and existing apps for malware. Also, we may want to consider installing one of the best Android antivirus apps for extra protection.
It is important to note that Premium Subscription Trojans may continue to be a threat in the future as they can be very profitable for scammers and most users do not discover unwanted subscriptions right away. That’s why it’s essential to regularly review subscriptions on the Play Store by checking subscriptions in the Payments & Subscriptions tab of your account profile, where you’ll find all your subscriptions, including unauthorized subscriptions.
