Avast Blog Threat Reseach: Adware hiding behind beauty filters on Google Play Store

[harlan4096]

Our mobile threat intelligence platform flagged three beauty apps that have ugly consequences. Over 2 million devices have downloaded these apps.

In February 2019, Avast’s mobile threat intelligence platform (MTIP), apklab.io, discovered a number of “selfie beauty apps” on the Google Play Store posing as legitimate apps, but in reality were filled with adware and spyware. The three apps we found are Pro Selfie Beauty Camera, Selfie Beauty Camera Pro, and Pretty Beauty Camera - 2019. The apps claim to add filters to selfie photos and modify the appearance of the people in the selfies. However, the apps primarily include adware that aggressively displays ads and spyware capable of making calls, listening to calls, retrieving the device’s location, and changing a device’s network state. The apps all have at least 500,000 installs, with Pretty Beauty Camera - 2019 having over one million installs. According to our data, the apps are mostly installed by Android users in India.

The apps have thousands of reviews, most of which rate the apps poorly, commenting that the apps don’t really work but instead display ads. There are, however, some positive reviews of the apps which are most likely fake.

Hidden beauty

Once the apps are installed and launched, they aggressively show ads within the app and even display full-screen ads outside of the apps when the phone is rebooted. The frequency of the ads is determined by a file downloaded from a remote command and control server.

Continue Reading