{"id":232537,"date":"2023-05-30T10:35:06","date_gmt":"2023-05-30T14:35:06","guid":{"rendered":"https:\/\/sftarticles.wpenginepowered.com\/es\/?p=291508"},"modified":"2025-07-01T19:03:59","modified_gmt":"2025-07-02T02:03:59","slug":"curious-case-popular-app-android-spy-users-one-year-after-exit-google-play","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/curious-case-popular-app-android-spy-users-one-year-after-exit-google-play\/","title":{"rendered":"The Hidden Dangers: A Deep Dive into the Android App That Secretly Spied on Users"},"content":{"rendered":"\n

A widely held belief among users is that Google Play<\/strong>, Google’s app store, typically maintains a minimum level of security and prevents criminals from uploading malicious apps<\/strong>. While the security of the virtual store has been questioned on occasion<\/a>, and we can find countless clone apps of ChatGPT<\/strong><\/a>, it is not very common to come across apps that contain malware.<\/p>\n\n\n

\r\n
\r\n
\r\n
\r\n \"Google\r\n <\/div>\r\n
\r\n Google Play<\/span>\r\n DOWNLOAD<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

It is not very common, but every now and then, one manages to slip through. TechCrunch<\/a><\/strong> has reported on an investigation<\/a> by ESET, which claims that the app “iRecorder – Screen Recorder”<\/strong> was spying on its users. What is most striking about this case is that the app enjoyed great popularity and had been on Google Play for a year already<\/strong>.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

According to Lukas Stefanko<\/strong>, a security researcher at ESET, the app initially did not contain any malicious functions when it was first uploaded to Google Play. The malicious code was inserted in a recent update<\/strong>, allowing the app to record audio for one minute every 15 minutes and extract documents, web pages, and media files from the devices where it was installed. All of this was done without the user’s knowledge<\/strong>.<\/p>\n\n\n\n

This type of malware is categorized as AhRat<\/strong> by ESET and is a customized version of an open-source remote access Trojan called AhMyth<\/strong>. Such trojans take advantage of their broad access to the victim’s device<\/strong>, having various permissions, and the ability to remotely control the infected devices<\/strong>.<\/p>\n\n\n

\r\n
\r\n
\r\n
\r\n \"Google\r\n <\/div>\r\n
\r\n Google Play<\/span>\r\n DOWNLOAD<\/a>\r\n <\/div>\r\n
\r\n <\/path><\/path><\/text><\/svg>\r\n <\/div>\r\n <\/div>\r\n
\r\n <\/span>\r\n <\/div>\r\n
\r\n \r\n <\/div>\r\n <\/a>\r\n <\/div>\r\n<\/div>\n\n\n\n

Currently, it is unknown who installed the malicious code in the app’s update, which has already been removed from Google Play<\/strong>. It could have been the developer himself, “Coffeeholic Dev,” but it could also have been a third party<\/strong> who gained access to the developer’s account.<\/p>\n\n\n\n

Some of the links added in the article are part of affiliate campaigns and may represent benefits for Softonic.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

An ESET investigation found malicious code in a popular Android app that had been hosted on Google Play for more than a year.<\/p>\n","protected":false},"author":9256,"featured_media":232541,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":1},"categories":[1015],"tags":[2421],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-232537","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-app-subdomain-redirectiongoogle-play-store"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/232537","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9256"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=232537"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/232537\/revisions"}],"predecessor-version":[{"id":319997,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/232537\/revisions\/319997"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/232541"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=232537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=232537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=232537"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=232537"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=232537"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=232537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}