A new version of the Necro malware has been found on over 11 million Android devices, installed through Google Play apps in a widespread attack on the software supply chain. This malware was hidden within malicious advertising Software Development Kits (SDKs) that were integrated into legitimate apps, modified versions of popular programs, and even game mods.
View WhitepaperA new version of the Necro malware has been found on over 11million Android devices, installed through Google Play apps in a widespread attack on the software supply chain. This malware was hidden within malicious advertising Software Development Kits (SDKs) that were integrated into legitimate apps, modified versions of popular programs, and even game mods.
The malware made its way onto devices through legitimate apps using compromised SDKs. These SDKs were included in popular apps like modified versions of Spotify, WhatsApp, and Minecraft. Once installed, Necro can silently run on users' devices, deploying a variety of harmful tools.
Here’s what Necro does on infected devices:
The diagram below explains more in detail about how Necro spreads. If you’d like a more in-depth explanation, we recommend reading Kaspersky’s post on how the trojan infiltrated Google Play.
Source: Kaspersky
Security experts identified Necro in two popular apps available on Google Play:
The malware was distributed using an advertising SDK called "Coral SDK." The SDK used techniques like code obfuscation to hide its true function, making it difficult to detect. It even employed a method called image steganography, where harmful payloads were concealed inside seemingly harmless image files (such as PNGs).
If you have downloaded Wuta Camera or Max Browser, it’s critical to update Wuta Camera to the latest clean version and uninstall MaxBrowser entirely, as no safe version exists yet. Even if you’ve already deleted the apps, check your device for any unusual activity, such as unexpected ads or high data usage, as these could be signs of lingering malware.
Staying vigilant and regularly updating or uninstalling suspicious apps is essential to keeping your Android device secure.
In order to avoid falling victim to malware like Necro, it’s important to be cautious when downloading apps. Here are some steps to help keep your device safe:
By following these tips, you can greatly reduce the risk of malware infections and ensure your device remains safe from threats like Necro.
