A screen recording app named “iRecorder – Screen Recorder” from the Google Play Store was found to sneak in information stealing capabilities which was installed over fifty thousand times.
The app (APK package name “com.tsoft.app.iscreenrecorder”) was first uploaded on September 19, 2021. The malicious functionality is believed to have been introduced in version 1.3.8, which was released on August 24, 2022.
The new remote access Trojan (RAT) was discovered by researchers at ESET and according to them it is rare for a developer to upload a legitimate app, wait almost a year, and then update it with malicious code.
The malicious code that was added to the clean version of iRecorder is based on the open source AhMyth Android RAT and has been customized into AhRat.
iRecorder was first flagged as hiding the AhMyth trojan on October 28, 2022, by Kaspersky security analyst Igor Golovin. This indicated that the app managed to stay accessible all this time and even received a new update on February 26, 2023.
The application’s malicious activities include extracting microphone recordings and harvesting files with specific extensions. Google has now removed the app from the Play Store.
iRecorder is the work of a developer named Coffeeholic Dev, who has also released several other apps over the years, none of which are accessible now.
The AhRat research case serves as a good example of how an initially legitimate application can transform into a malicious one, even after many months, spying on its users and compromising their privacy.
Image Credits : Malwarebytes
Comments