Unofficial Android App Store APKPure Infected With Malware

APKPure, a popular alternative hub to download Android apps, was infected with malware that could be used to download Trojans to other Android devices, Kaspersky researchers report.

Google Play is the most official Android app store; however, it's only available on devices that use Google Mobile Services (GMS) and are tied to Google's infrastructure. Some vendors avoid GMS libraries because they want to be independent; they can because Android is an open OS.

This means those vendors lose access to Google Play, where most people go to install Android apps. Enter alternative stores like APKPure, which hosts only free or shareware apps. APKPure's owners say the apps in its shop are all clean and scanned by Google; however, researchers found the APKPure app itself wasn't quite as safe.

It seems APKPure version 3.17.18 was fitted with an advertisement SDK that had an embedded Trojan dropper. When launched, the Trojan runs a payload that can show ads on the lock screen, open browser tabs, collect device information, and most significantly, download other malware onto Android devices. The Trojan downloaded depends on the version of Android running.

Kaspersky shared their findings with APKPure on April 8 and received a response one day later indicating a fix was in the works. A new version (3.17.19) appeared on APKPure shortly after.

Read Kaspersky's full blog post and technical writeup for more details.