Google Play has revealed a new batch of fifteen SpyLoan Android malware applications that have amassed over eight million installs; these apps mostly target consumers in South America, Southeast Asia, and Africa.
An program from the ‘program Defense Alliance,’ McAfee, was found and removed from the official Android app store.
According to McAfee, the issue remains unsolved despite recent legal proceedings against SpyLoan operators. The fact that they are still visible on Google Play shows how persistent the threat actors are.
Twelve applications with twelve million downloads were deleted in the most recent “SpyLoan cleanup” on Google Play in December 2023.
Methods used by SpyLoan
The SpyLoan app is a piece of financial software that advertises itself as a way to get a loan quickly, but in reality, it uses misleading and outright fake conditions to do so.
Victims’ location in the target region is confirmed when they install the apps using a one-time password (OTP). Their next step is to provide personal information such as their banking details, identification cards, and employment records.
In addition, the apps abuse their device rights to gather a lot of personal information, such as the user’s location, contact list, SMS, camera, and call history, which they then utilize for extortion.
According to McAfee, these programs actively collect data by going through the victim’s SMS messages, GPS/network position, device information, operating system details, and sensor data.
Once a user gets a loan through the app, they are bound to high-interest payments, and regularly harassed and blackmailed by the operators using the data stolen from their phones. In some cases, the scammers call family members of the loanee, harassing them as well.
8 million downloads on Google Play
McAfee’s investigation identified 15 malicious SpyLoan apps, which have been installed over 8 million times through the Play Store alone. Below is a list of the eight most popular:
- Préstamo Seguro-Rápido, Seguro – 1,000,000 downloads, primarily targets Mexico
- Préstamo Rápido-Credit Easy – 1,000,000 downloads, primarily targets Colombia
- ได้บาทง่ายๆ-สินเชื่อด่วน – 1,000,000 downloads, primarily targets Senegal
- RupiahKilat-Dana cair – 1,000,000 downloads, primarily targets Senegal
- ยืมอย่างมีความสุข – เงินกู้ – 1,000,000 downloads, primarily targets Thailand
- เงินมีความสุข – สินเชื่อด่วน – 1,000,000 downloads, primarily targets Thailand
- KreditKu-Uang Online – 500,000 downloads, primarily targets Indonesia
- Dana Kilat-Pinjaman kecil – 500,000 downloads, primarily targets Indonesia
Despite Google’s app review mechanisms to block software that violates the Play Store’s terms, SpyLoan apps continue to slip through the cracks.
To protect against this risk, read user reviews, check the developer’s reputation, limit the permissions granted to apps upon installation, and make sure Google Play Protect is active on the device.