Search for malware in an application downloaded 100 million times on Android

Kaspersky researchers recently discovered malware in a popular Android operating system, with more than 100 million downloads of the CamScanner application.

CamScanner is used to create PDF files via a smartphone and includes OCR (Optical Character Recognition) technology. According to the company, several sources call the application under different names, such as: CamScanner – Phone PDF Creator and CamScanner -Scanner.

Although official app stores such as Google Play are secure for downloading apps, they are not always 100% secure. Some agencies sometimes bypass Google's security restrictions, which, despite their power, are difficult to accurately verify millions of applications.

The researchers said Kaspersky: The application of CamScanner has long been safe and legal, with no malicious intent. He used ads for monetization, as well as for in-app purchases. "However, at one point, this has changed, and recent versions of the application now include an ad library with a malicious module."

Kaspersky said in an article on his blog: that his products discovered this unit under the name of Trojan-Dropper.AndroidOS.Necro.n, and had noticed some applications preinstalled on Chinese smartphones. As its name indicates, the module is a Trojan virus. This means that the module retrieves and manages another malicious module from an encrypted file listed in the application's resources. This "deleted" malware is also a Trojan downloader that downloads more malicious modules based on what the creators do.

"For example, an application with malicious code may display intrusive ads prompting users to subscribe to paid subscriptions," the company said. Some CamScanner users have already discovered suspicious behavior, leaving notes on the Google Play page of the app with warnings allowing them to avoid the application.

Kaspersky researchers examined a recent version of the application and found the malicious module. The company informed Google of its findings and the application was immediately removed from the Google Play Store.

Kaspersky researchers said that it appeared that the developers of the application had gotten rid of the malicious code thanks to the latest update of the CamScanner program. However, the researchers warned that the versions of the application differed from one device to the other and that some could still contain malicious code.