Kaspersky says it informed APKPure of the problem last week and the company confirmed a fix was incoming. The xHelper attack is much harder to remove, with even a factory reset failing. Because there older versions are more rootable, a more robust Trojan is possible. This is an attack that automatically buys premium subscriptions and adds more malware to a system.įor older versions of the platform with security updates, the xHelper Trojan is being used. “Which Trojan gets downloaded (in addition to APKPure’s built-in one) depends on the Android version, as well as on how regularly the smartphone vendor released - and the user installed - security updates.” Fixįor example, users running Android 8 or newer, the malware will load more Triada Trojan modules. More worryingly, it also collects information from the Android device and download other malware to the system. Once unpacked, the payload randomly opens browser tabs, locks the screen, and shows ads. This is HEUR:, which delivers a malicious payload when launched.

In the post, the security firm shows APKPure version 3.17.18 comes with an advertisement SDK featuring a Trojan dropper. That’s because it is easier for a threat actor to place a malicious app on an unofficial store than trying to pass Google’s security. The company points out third-party stores often have malicious apps.

As result, Kaspersky advises users to only download applications from official stores. However, one of the biggest third-party stores, APKPure, has been found to be spreading Trojans.Īnti-virus giant Kaspersky Lab has published a blog saying APKPure has been Trojanized and distributing Trojans. Other third-party app stores are also available, allowing users to access different applications or to avoid having a Google account. While the Google Play Store has nearly a million apps for Android, it is not the only way to get apps on the platform.

Malwarebytes apkpure