The Google Play Store and App Store provide significant convenience for users and a great platform for developers to earn income. However, these open marketplaces can also present risks. A recent incident highlighted this concern, when a legitimate app on the Google Play Store became malicious, secretly sending microphone recordings every 15 minutes. Here are the details…

Google Play Store App iRecorder Transforms into Malicious Spyware That Records Audio from Users

ESET, a name most of us recognize from antivirus software, recently made a dangerous discovery during their tests. According to the company, an app called iRecorder Screen Recorder, available on Google Play Store, records audio every 15 minutes and sends it to the app developer. This scandalous news once again proves that even applications available in official stores cannot always be trusted.

Google Play Store malware

The iRecorder Screen Recorder app, initially launched on the Google Play Store in September 2021, took a dark turn with an update in August 2022. This update incorporated AhMyth, an open-source Remote Access Trojan (RAT), turning the app into a stealthy espionage tool. The RAT gave the app the ability to remotely record audio, link to an attacker’s server, and upload recorded audio and sensitive files.

This update fundamentally shifted the trajectory of the app, turning all of its users into potential victims. The truly terrifying part lies exactly here. Many users, without realizing, have been using the app in this condition for almost nine months, and their voices have been recorded. After the incident came to light, Google removed the iRecorder Screen Recorder app from the Play Store. However, you are also advised to be careful and take the necessary precautions if you have downloaded this app even once.

Communications between an AhRat-infected device and the C2.

Google’s Malware Problem

Despite Google’s best efforts, apps laced with malware have continuously plagued its platform. The technology behemoth usually reacts swiftly in expunging these hazardous apps upon detection. However, their preventive measures to stop these apps from making their way into the Google Play Store in the first place have been less effective. In addition, there has been a perceived lack of transparency about the reasons behind the failure of Google’s own security measures to identify these looming threats.

This most recent case underscores the issue. It involves an application that clandestinely records audio, compromising the privacy of a broad user base. ESET officials suggest that the app, iRecorder, might be part of an active espionage campaign. Yet, without additional evidence to substantiate this claim, it remains just a hypothesis. Google’s role in permitting such a dangerous application to exist on its Play Store, hence, raises questions about culpability and effective digital security measures.

RELATED:

(via)