A while back, a malware called Brain Test popped up in various Play Store apps. It would copy files from its host app into different places to make itself hard to remove. Generally, annoyance and a factory reset followed, peppered with an occasional trip to the carrier store or sleepless night spent learning how to re-flash your stock ROM, on some devices.
Users that had rooted their manufacturer’s software or flashed a custom ROM faced a bit more of an ordeal at the malware’s hands. Not only would it make itself nigh-impossible to remove, requiring users to wipe their system partition through a custom recovery, it would also hijack users’ devices to install other infected apps, normally from the same developer or a contract client, and leave positive reviews for those apps. In essence, this made users part of a botnet. In the PC world, selling guaranteed installs to indie developers is common practice and is often executed in a similar manner, meaning that could have been the situation when the malware had its first go around. Google eventually managed to banish it from the Play Store.
The Brain Test malware came back in a grand total of 13 known apps so far, all of which have been given the boot from the Play Store. These, however, are just the ones that Lookout was able to find via a common link to a master server and report to Google. It’s almost certain that a number of other apps are out there that bear this malware. The affected batch of apps, all from the same developer under different names, had the same function as the original batch of Brain Test apps. Mostly, the apps affected were simple puzzle games, some of which were genuinely functional and enjoyable. The apps were Cake Blast, Jump Planet, Honey Comb, Crazy Block, Crazy Jelly, Tiny Puzzle, Ninja Hook, Piggy Jump, Just Fire, Eat Bubble, Hit Planet, Cake Tower and Drag Box. Google does the best they can to police the Play Store, but things slip through at times. This doesn’t mean that the Play Store is just as unsafe as third party sources. Grabbing a random APK from the internet and installing it without a second thought is still an incredibly dumb move no matter what device you own or how much you know about its software. In light of this incident, extra vigilance in your downloads is called for. That’s not to say that every one-off game from pop-up devs are dangerous, but some homework and some trusting of your gut is never a bad idea. You are downloading these apps, after all, to a device that contains your personal information and digital identity.