Android antivirus apps caught spreading their own malware

Google has removed a number of fake Android antivirus apps from the Play Store after it was discovered they were being used as a vehicle for malware distribution.

According to cybersecurity experts from Check Point Research, the company responsible for the discovery, at least half a dozen antivirus apps available on the official Android marketplace were being used to spread banking malware. 

The apps in question are called:

• Atom Clean-Booster, Antivirus
• Antivirus, Super Cleaner
• Alpha Antivirus, Cleaner
• Powerful Cleaner, Antivirus
• Center Security – Antivirus (two versions)

These malicious apps were carrying Sharkbot, a malware strain that steals passwords and banking information. It shares push notifications and offers up fake login prompts, through which users share their credentials with the attackers. 

Although all have since been removed from the Play Store, Check Point says they still remain active in unofficial markets. Android users who had downloaded the apps before they were removed are advised to uninstall them immediately.