In 2019, Kasperski told us about the Camscanner application, a PDF file creator that was a download success among users and had been contaminated with a Trojan;In mid -March more than 200 applications infected with a malicious code nicknamed as “Simbad”, which were available in the official Google Play store, and which affected 150 million users were detected;As soon as May we had another case with malware that had exceeded Google security mechanisms.

In July of that year we saw 7 apps that Google Play had eliminated from their store because they dedicated themselves to spying on who took them on their smartphone without knowing it;And today we find a new malware that with such a name could not be anything else: The Joker.

New Joker malware

Baptized as one of the most essential and authentic comics villains of popular culture -and also fashionable by the homonymous film that is sweeping prizes -The Joker is a malware that has managed to sneak into many applications within the Google PlayAndroid Store.The virus acts in 2 phases, and its danger is not only that the data steals, but also steals money in real time.Thus acts:

Fase 1

Fase 2:

A malware that steals money

The worst of that second phase is that the malware Joker begins to interact with advertisement websites, using authorization codes for premium subscriptions of those pages and simulating clicks in banners and others, that is: pointing to us in advertising services that we have not requested.Through this technique, Joker can be done with up to 6.71 euros a week in countries such as Denmark thanks to the automation of the process of interacting with the premiun offer of a specific website.

In order to maximize their attacks but minimize its risks of being caught, The Joker only acts in a certain number of countries -Spain included.In fact, many of the apps infected with this malware have an MCC, a list of mobile codes from countries, to know which one is operating.If you use a SIM of one of the countries in the list, phase 2 of the virus is activated, which implies the SMS, data and monetary action.

The majority of compromised applications act in countries in Europe and Asia, and have an additional check to avoid doing so in the United States or Canada, although some apps do infect North American Sim cards.

Countries affected by Joker

Infected applications

¿De dónde viene este malware? Aunque seguirle la pista es complicado, lo cierto es que tanto la interfaz de usuario del panel C&C de Joker como algunos de los comentarios en su código base están escritos en chino.

And, after infecting more than 500 thousand mobiles from the Huawei brand, the Joker has returned.And despite the safety of the Android store, The Joker has returned to sneak into up to 8 applications, some of them with more than 100.000 downloads.

As Belgium Police are notifying, these eight applications are those that have thrown positive in terms of having the evil virus:

Like the previous variants, it can also subscribe to users to websites that offer payment services, which means that users risk getting a big surprise at the end of the month when the extract of their bank account or credit cardReach the mailbox.In the past, some victims have found themselves paying more than 240 pounds (279 euros) a year for these fraudulent subscriptions.