Google Play 'Update' May Be Scam

Android scammers are using a creatively nasty way to spread malware. They've disguised it as an update for the Google Play store itself.

It's a particularly cheeky way to try to get credibility for a malware scam. Not only is Google Play the official place to get Android apps in the first place, but the best and simplest Android security tip is to only use apps from Google Play.

In this case, the malware doesn't originate as an app but instead as a bogus link. This could be on a web page, in a text message or in an email. The supposed source is Google itself and the link comes with a message that claims the user needs to update Google Play.

Tapping the link downloads what appears to be an update and comes with specific instructions to follow. These instructions are actually for disabling the default setting in Android that blocks apps from outside of Google Play.

Money At Risk

When the user installs the "update," they are actually installing an app that's named "New Version" to continue the confusion. The installation process then asks the user to grant several permissions. These are the key to the malware infection.

The rogue app is able to carry out numerous tasks including screen recording, tracking keystrokes, reading text messages (including security checks) and putting a fake window "on top of" legitimate screens to trick the user into inputting sensitive data.

That all adds up to an attack that's designed to access financial accounts and capture passwords and other login details without detection. The app also communicates with a remote server to get ongoing instructions. (Source: phonearena.com)

Auto Updates Best Bet

The best defense is to ignore any message that claims to offer or require an update to an app, no matter who it appears to come from.

Instead, enable automatic updates in the "Network preferences" settings menu of the actual Google Play Store app. This means never having to manually update apps and making it safe to ignore any warning to do so. (Source: techradar.com)

What's Your Opinion?

Would you have fallen for this scam? Do you have automatic updates switched on in your device? How often, if ever, do you install apps from outside the official store for your mobile device?