Google Play app downloaded 50,000 times made secret mic recordings every 15 minutes

In brief: One effective way that a malicious Android app on the Play Store can avoid Google's detections is to arrive as a clean, legitimate program before the malware elements are implemented at a later date. That's what happened with iRecorder - Screen Recorder. The app, which was downloaded 50,000 times, was secretly making audio recordings with a device mic every 15 minutes and sending them to an attacker.

ESET researcher Lukas Stefanko discovered that iRecorder - Screen Recorder had become trojanized over the last year. The app first arrived on Google Play in September 2021, when it was free from any malicious elements, but that changed when the version 1.3.8 update came in August 2022.

The malicious code added to the app is based on the open-source AhMyth Android RAT (remote access trojan) malware that is able to steal data from devices, including contacts, SMS messages ...