\n<\/p>\n
A cybersecurity firm says a popular Android screen recording app that racked up tens of thousands of downloads on Google\u2019s app store subsequently began spying on its users, including by stealing microphone recordings and other documents from the user\u2019s phone.<\/p>\n
Research by ESET found that the Android app, \u201ciRecorder \u2014 Screen Recorder,\u201d introduced the malicious code as an app update almost a year after it was first listed on Google Play. The code, according to ESET, allowed the app to stealthily upload a minute of ambient audio from the device\u2019s microphone every 15 minutes, as well as exfiltrate documents, web pages and media files from the user\u2019s phone.<\/p>\n
The app is no longer listed<\/a> in Google Play. If you have installed the app, you should delete it from your device. By the time the malicious app was pulled from the app store, it had racked up more than 50,000 downloads.<\/p>\n ESET is calling the malicious code AhRat, a customized version of an open-source remote access trojan called AhMyth. Remote access trojans (or RATs) take advantage of broad access to a victim\u2019s device and can often include remote control, but also function similarly to spyware<\/a> and stalkerware<\/a>.<\/p>\n A screenshot of iRecorder listed in Google Play as it was cached in the Internet Archive in 2022. Image Credits:<\/b> TechCrunch (screenshot)<\/p>\n<\/div>\n Lukas Stefanko, a security researcher at ESET who discovered the malware, said in a blog post<\/a> that the iRecorder app contained no malicious features when it first launched in September 2021.<\/p>\n Once the malicious AhRat code was pushed as an app update to existing users (and new users who would download the app directly from Google Play), the app began stealthily accessing the user\u2019s microphone and uploading the user\u2019s phone data to a server controlled by the malware\u2019s operator. Stefanko said that the audio recording \u201cfit within the already defined app permissions model,\u201d given that the app was by nature designed to capture the device\u2019s screen recordings and would ask to be granted access to the device\u2019s microphone.<\/p>\n It\u2019s not clear who planted the malicious code \u2014 whether the developer or by someone else \u2014 or for what reason. TechCrunch emailed the developer\u2019s email address that was on the app\u2019s listing before it was pulled, but has not yet heard back.<\/p>\n Stefanko said the malicious code is likely part of a wider espionage campaign \u2014 where hackers work to collect information on targets of their choosing \u2014 sometimes on behalf of governments or for financially motivated reasons. He said it was \u201crare for a developer to upload a legitimate app, wait almost a year, and then update it with malicious code.\u201d<\/p>\n It\u2019s not uncommon for bad apps<\/a> to slip into the app stores, nor is it the first time AhMyth has crept its way<\/a> into Google Play. Both Google and Apple screen apps for malware before listing them for download, and sometimes act proactively to pull apps<\/a> when they might put users at risk. Last year, Google said<\/a> it prevented more than 1.4 million privacy-violating apps from reaching Google Play.<\/p>\n<\/p><\/div>\n