<\/p>\n
<\/p>\n
Luckily, you can avoid both malware and potentially unwanted applications (PUAs) by being cautious and doing your diligence. Our tips below will help you to spot a potentially dodgy app from miles away, as well as get your phone back into shape if you downloaded such an app.<\/p>\n
<\/p>\n
<\/p>\n
How to recognize a fake app<\/h2>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Check the numbers<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Say you\u2019re looking for what you would reasonably expect to be an app with hundreds of millions of users but only come across an app that, while sounding like the real thing, hasn\u2019t racked up nowhere near as many downloads. If that\u2019s the case, chances are high you\u2019re dealing with an imposter app.<\/p>\n
<\/p>\n
<\/p>\n
Indeed, be cautious whenever you\u2019re looking to download an app that has been the talk of the town lately. Cybercriminals are always eager to piggyback off a surge in the popularity of an app or service in order to push copycat apps to the market. One recent example is a slew of sketchy apps that attempt to ride the ChatGPT craze<\/a> and that were rolled out even before the official app was released.<\/p>\n
<\/p>\n
<\/p>\n
Much the same applies to bogus updates for legitimate and widely-used apps. One example is the curious case of WhatsApp Pink<\/a>, a fake color theme for WhatsApp that was peddled via messages on the app in 2021.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Read the reviews<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
If an app is rated poorly, you should probably give it a pass. On the other hand, tons of glowing reviews that all sound almost the same should also raise eyebrows. This is especially the case with apps that have not been downloaded millions of times \u2013 many of those recommendations may be the work of fake reviewers or even bots.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Check the visuals<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Something about the app\u2019s color or logo used doesn\u2019t feel right \u2026 If you\u2019re in doubt, compare the visuals to those on the website of the service provider. Malicious apps often their mimic legitimate counterparts and use similar, but not necessarily identical, logos.<\/p>\n
<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/fake-msqrd-app.png\")
<\/p>\n<\/p>\n
<\/p>\n
The impostor is on the right (source: ESET Research<\/a>)<\/em><\/p>\n
<\/p>\n
<\/p>\n
However, don\u2019t be lulled into a false sense of security just because you recognized the logo of a well-known bank, payment processor or cryptocurrency wallet. Some apps not only misuse the name of a legit service, but are also distributed via websites that are the spitting images of the legitimate sites<\/a>. Keep your eyes peeled for details \u2013 a closer look, including at the URLs, often reveals some giveaways.<\/p>\n
<\/p>\n
<\/p>\n
![\"Figure-2a.-PetsMore-legitimate-website-on-the-left-copycat-on-the-right.png\"\/](\"https:\/\/web-assets.esetstatic.com\/wls\/2022\/04\/Figure-2a.-PetsMore-legitimate-website-on-the-left-copycat-on-the-right.png\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
![\"Figure-2b.-PetsMore-legitimate-website-on-the-left-copycat-on-the-right.png\"\/](\"https:\/\/web-assets.esetstatic.com\/wls\/2022\/04\/Figure-2b.-PetsMore-legitimate-website-on-the-left-copycat-on-the-right.png\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
Legitimate website on the left, copycat on the right<\/em> (Source: <\/em>ESET Research<\/em><\/a>)<\/em><\/p>\n
<\/p>\n
<\/p>\n
![\"fake-telegram-website.png\"\/](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/fake-telegram-website.png\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
![\"fake-whatsapp-website.png\"\/](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/fake-whatsapp-website.png\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
Websites impersonating Telegram and WhatsApp (Source: <\/em>ESET Research<\/em><\/a>)<\/em><\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Doublecheck the \u201cofficial app\u201d claims<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
In one case documented by ESET research<\/a> last year, cybercriminals distributed apps for online stores and banks that often didn\u2019t even have an app available on Google Play.<\/p>\n
<\/p>\n
<\/p>\n
When downloading a mobile app that should be associated with a popular online service, make sure that the service actually offers such an app. If that\u2019s the case, its official website will contains links to the apps in Google Play Store and\/or Apple App Store. The number and variety of malicious ChatGPT-themed apps<\/a> is a handy example.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Check the app\u2019s name and description<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Legitimate app developers typically go to great pains to avoid coming across as unprofessional. This also applies to things as mundane as app descriptions \u2013 read through them to see if you can spot poor grammar or inconsistent and incomplete details. These often provide a clue that an app isn\u2019t what it\u2019s claimed to be.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Check the developer\u2019s pedigree<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Tread also carefully when dealing with an app from an unknown app developer with no track record in app development. Don\u2019t be fooled by a name that rings a bell, either \u2013 shady app makers may be misusing the name of a legitimate and well-known entity. Doublecheck if the developer has other apps to their name and that the apps are reputable; if in doubt, search for the developer\u2019s name in Google.<\/p>\n
<\/p>\n
<\/p>\n
READ ALSO: <\/em>Tracking down the developer of Android adware affecting millions of users<\/em><\/a><\/em><\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Look out for excessive app permissions<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Last but definitely not least, stay away from apps that require excessive user permissions \u2013 that is, the kinds of privileges that they don\u2019t really need to do their job. A flashlight app hardly needs admin rights<\/a> and access to core device functionality.<\/p>\n
<\/p>\n
<\/p>\n
7 ways to tell that you downloaded a risky app<\/h2>\n
<\/p>\n
<\/p>\n
Here are a few signs that your newly-installed app could be sketchy:<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- The app isn\u2019t doing its job<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
As an example, back in 2018 ESET researchers analyzed a set of apps that posed as security solutions<\/a>, but all they did was display unwanted ads and offer pseudo-security. They only mimicked basic security functions with very primitive security checkers that relied on a few trivial hardcoded rules. As a result, they often detected legitimate apps as malicious and created a false sense of security in the victims.<\/p>\n
<\/p>\n
<\/p>\n
If your new \u201cgame\u201d turns out to be a gambling platform, something isn\u2019t right. Check again what it is that you\u2019ve actually downloaded.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- It behaves strangely<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Does the app exhibit weird behavior, such as starting up, closing, or failing altogether for no apparent reason? This is one of the most obvious signs that you may have downloaded a dodgy app<\/a>.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- You incurred unexpected charges <\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
If you\u2019ve spotted unwanted charges on your credit card or phone bill, it could be due to an app you downloaded recently.<\/p>\n
<\/p>\n
<\/p>\n
As an example, ESET researchers spotted multiple apps that posed as fitness-tracking tools<\/a> and abused Apple\u2019s Touch ID feature to steal money from iOS users. After a user launched one of the apps for the first time, it requested a fingerprint scan to \u201cview their personalized calorie tracker and diet recommendations\u201d. If the user had a credit or debit card directly connected to an Apple account, the malware would go on to steal money from the victims via fraudulent in-app payments.<\/p>\n
<\/p>\n
<\/p>\n
Watch out for scams that involve downloading a peer-to-peer (P2P) payment service and offer fictitious products and services at fire sale prices. Because payments are often instant and cannot be canceled, you may lose money by paying for something you will never receive.<\/p>\n
<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/dodgy-ios-apps-1.png\")
<\/figure>\n<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/dodgy-ios-apps-2.png\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
<\/a><\/p>\n
<\/p>\n
<\/p>\n
Figure 4. Sketchy iOS apps asking users to scan their fingers for fitness tracking before showing dodgy payments<\/em><\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Strange messages and calls<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Another sign of trouble involves malware spamming out messages from your phone to your contacts (like FluBot does<\/a>). In other cases, your call or text message history may contain unknown entries as malware attempts to make unauthorized calls or send messages to premium-rate numbers.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Battery drain<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
Does your device battery get drained far faster than usual? It may be due to background activity that consumes the device\u2019s resources and could ultimately indicate that your device has been compromised by malware.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Spikes in data usage<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
If you experience a major and sudden surge in your internet data usage without any change in your browsing or phone usage habits, it could also be because of an app\u2019s activity in the background.<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Random ad pop-ups and unknown apps<\/strong><\/li>\n
<\/ul>\n
<\/p>\n
<\/p>\n
A malicious app may go on to install additional apps in the background and without your authorization. The same goes for pesky adware displaying unwanted ads on your device. If you spot any of this, chances are high you need to act fast.<\/p>\n
<\/p>\n
<\/p>\n
What to do next?<\/h2>\n
<\/p>\n
<\/p>\n
After discovering what you suspect is a sketchy app, remove it or, even better, download reputable mobile security software that will scan your device and remove the app for you.<\/p>\n
<\/p>\n
<\/p>\n
If you go the \u201cmanual\u201d route instead, reset your phone to factory settings (prior to that, make sure you have your data backed up<\/a>). Alternatively, you may sometimes have to boot up your device in Safe Mode and then remove the app. The video by ESET malware researcher Lukas Stefanko<\/a> shows you how:<\/p>\n
<\/p>\n
<\/p>\n
https:\/\/youtube.com\/watch?v=dIIDh1AqUKQ%3Fenablejsapi%3D1%26origin%3Dhttps%253A%252F%252Fwww.welivesecurity.com<\/p>\n
<\/p>\n
<\/p>\n
Also, do other potential victims a favor and report the app to the relevant app store from which you downloaded the app. You can also try to claim a refund.<\/p>\n
<\/p>\n
<\/p>\n
Going forward, if you use apps from the Google Play Store, make sure to enable the Google Play Protect scanning<\/a> on your device. You can also check the apps you\u2019ve downloaded from outside of the Google Play Store. To do so, turn on \u201cImprove harmful app detection\u201d, which will send unknown apps to Google automatically.<\/p>\n
<\/p>\n
<\/p>\n
![\"\"](\"https:\/\/web-assets.esetstatic.com\/wls\/2023\/06\/google-play-store-play-protect-settings.jpg\")
<\/a><\/figure>\n<\/p>\n
<\/p>\n
What if you\u2019re an iOS user? Contrary to what many people may think, downloading a dodgy app on iOS, even from Apple App Store, isn\u2019t unheard of. For more on what to do if a bad app(le) slipped through the iOS safety net, head over to our recent deep dive into the topic:
Can your iPhone be hacked? What to know about iOS security<\/a> <\/p>\n<\/p>\n
<\/p>\n
7 tips for staying safe<\/h2>\n
<\/p>\n
<\/p>\n
Finally, a few quick tips for staying safe while using your mobile device:<\/p>\n
<\/p>\n
<\/p>\n
- <\/p>\n
- Stick to Google Play and Apple App Store; i.e., avoid putting yourself at risk by installing apps from third-party stores.<\/li>\n
<\/p>\n
<\/p>\n
- Don\u2019t mindlessly click on links sent via social media messages or emails.<\/li>\n
<\/p>\n
<\/p>\n
- Use two-factor authentication (2FA) on all your online accounts that offer it, especially on those that contain your valuable data.<\/li>\n
<\/p>\n
<\/p>\n
- Keep your phone\u2019s operating system and apps up-to-date.<\/li>\n
<\/p>\n
<\/p>\n
- Stick to apps whose developers continue to improve their products and fix security vulnerabilities and performance bugs.<\/li>\n
<\/p>\n
<\/p>\n
- Secure your device\u2019s screen<\/a> with a passcode sufficient length and complexity or a solid biometric feature such as a fingerprint \u2013 or, ideally, a combination of both!<\/li>\n
<\/p>\n
<\/p>\n
- Use mobile security software.<\/li>\n
<\/ul>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
You\u2019ve just downloaded a new mobile game, cryptocurrency wallet, or fitness app, but something isn\u2019t right. Your phone\u2019s screen is swamped by annoying ads, the app is not doing what you would expect it do, and, God forbid, you found an unauthorized transaction on your bank account. Chances are good that the app you downloaded […]<\/p>\n","protected":false},"author":5,"featured_media":6749,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2904,2899,2907],"tags":[],"class_list":["post-6753","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dom-i-semya","category-kiberprestupnost","category-ustrojstva-platformy"],"acf":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/posts\/6753","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/comments?post=6753"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/posts\/6753\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/media\/6749"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/media?parent=6753"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/categories?post=6753"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/ru\/wp-json\/wp\/v2\/tags?post=6753"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Use mobile security software.<\/li>\n
- Stick to Google Play and Apple App Store; i.e., avoid putting yourself at risk by installing apps from third-party stores.<\/li>\n
- Random ad pop-ups and unknown apps<\/strong><\/li>\n
- Spikes in data usage<\/strong><\/li>\n
- Battery drain<\/strong><\/li>\n
- Strange messages and calls<\/strong><\/li>\n
- You incurred unexpected charges <\/strong><\/li>\n
- It behaves strangely<\/strong><\/li>\n
- The app isn\u2019t doing its job<\/strong><\/li>\n
- Look out for excessive app permissions<\/strong><\/li>\n
- Check the developer\u2019s pedigree<\/strong><\/li>\n
- Check the app\u2019s name and description<\/strong><\/li>\n
- Doublecheck the \u201cofficial app\u201d claims<\/strong><\/li>\n
- Check the visuals<\/strong><\/li>\n
- Read the reviews<\/strong><\/li>\n