“Necro” infects 11 million Android devices and hits the Google Play Store

The Google Play Store has been used to distribute malware to Android users

Kaspersky has reported that 11 million Android users have been infected with the “Necro” trojan, with the malware hitting popular mod apps as well as the Google Play Store itself. Yes, even Google isn’t immune to Malware, though it is worth noting that only two apps have been infected with “Necro”.

“Necro” is malicious software that is installed into apps through infected software SDKs. It is typically found in modded versions of popular Android software like Spotify, WhatsApp, and Minecraft. Once installed, it infects systems with other pieces of malicious software. This includes adware, fraudware, and tools that can allow devices to be used as proxies for other attacks.

On the Google Play Store, the Wuta Camera app and Max Browser were found to be infected with Necro. Wuta Camera has over 10 million downloads. Version 6.3.2.148 of Wuta Camera contained the Trojan; newer app versions have removed this malware. However, app users may still have malware payloads installed on their devices. Kaspersky claims that these two apps were infected through an invested advertising SDK called “Coral SDK”.

(Kaspersky claims that the Necro Trojan has attacked over 11 million Android devices)

How to guard against Necro on Android

Since the vast majority of Necro-infected apps are hacked/modified applications, most Android users can avoid the malware by only downloading applications from official sources. However, it is always possible that official apps may become infected, like the Google Play version of Wuta Camera. For added peace of mind, users should consider installing antivirus software onto their devices.

Kaspersky, obviously, recommends their own software as an Android antivirus solution. However, it is worth noting that Kaspersky software has been banned in the US on National Security grounds. If you are considering using antivirus software on Android, perhaps you should consider other options.

You can join the discussion on 11 million devices getting infected by the “Necro trojan” on the OC3D Forums.