Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


03:00 PM
Dark Reading
Dark Reading
Products and Releases

Sophisticated CAPCHA-Bypassing Malware Found in Google Play, According to Bitdefender Researchers

A sophisticated CAPCHA-bypassing Android malware has been found harbored in Google Play apps seeking to covertly subscribe thousands of users to premium-rate services.

Identified by Bitdefender as Android.Trojan.MKero.A, the malware was first spotted in late 2014, but was only distributed via third-party marketplaces or local popular social networks in Eastern Europe. One of the most affected countries was Russia.

At the time, Bitdefender was conducting its own research into the malware’s behavior and found that recent versions had stopped using the highly advanced packer - that eased its detection – but still uses obfuscated strings.

Current Capabilities

This is the malware’s first occurrence in the official Google Play store, suggesting its developers found new ways of packing it into seemingly legitimate apps that can bypass Google Bouncer - the Google’s vetting system.

The Trojan’s sophistication lies in its ability to bypass CAPCHA authentication systems by redirecting these requests to an online image-to-text recognition service, Antigate.com. Because the online service relies on actual individuals to recognize CAPPCHA images, requests are sent back to the malware within seconds so that it can proceed with the covert subscription process.


The Trojan relies on a Command and Control (C&C) infrastructure to receive configuration settings about desired subscription services and relay received SMS messages. The subscription procedure involves the following steps:

·         Loading a target website received from the C&C server;

·         Extracting CAPCHA image and sending it for image-to-text recognition;

·         Loading the CAPCHA code on the targeted website;

·         Parsing SMS code for code or activation link;

·         Loading activation link;

·         Sending confirmation SMS;

·         Loading website with SMS code.

To further complicate analysis of the malware, its developers used obfuscation tools to hide classes, functions and C&C servers from where it receives commands and instructions.

After analyzing a list of seven malware-harboring Google Play applications, a list of 29 randomly generated C&C servers names were pulled from a single sample that did not have encrypted strings. If any one of these locations becomes unresponsive –due to a takedown or any other reason – the malware on any infected device will automatically try to connect to the next C&C server in the preconfigured list and wait for instructions.


Among Google Play apps that disseminate the Trojan, two have between 100,000 and 500,000 installs each, raising the potential victim count to staggering numbers.

For each of the applications found in Google Play, we also analyzed previous versions to discern if they had just been recently weaponized or had been hiding in plain sight for while. Our findings confirmed that several go back at least five iterations, meaning they have been in the official Google Play marketplace for a long time  - exhibiting malicious behavior - and have been constantly updated.

At least one developer, by the name of “Like Gaming,” has been found publishing more than one of these malicious apps. However, he has stopped using the Trojan in certain versions of his application.

Here’s the list of the malicious apps that at the time of writing have been found in Google Play, along with the MD5 for each version known to have harbored the same malicious behavior:


1.       com.irontubegames.tower3d    

Version: 8 1.0.8 – MD5: c8455e21d9768d5976fdfe867605a8de

2.       com.likegaming.rd            

                Version: 3 1.3 – MD5: e3b1ecb491ecf424358ead583b21d8f6

                Version: 5 1.5 392d9472352a1af31acde7cbb26c854e

3.       com.likegaming.gtascs        

                Version:  1 1.0 – MD5: 14cdf116704af262174eb0678fd1b368

4.       com.likegaming.rcdtwo        

                Version: 4 1.3 – MD5: 869624aeef3a9c848ed4e657dc852fff

                Version: 7 1.6 - MD5: 39b84a45e82d547dc967d282d7a7cd1e

                Version: 5 1.4 - MD5: 3692d7b6e121d36106f808622cdd52e7

5.       com.likegaming.rcd

                Version: 10 1.8 – MD5: 0460d0a51dcf3e4b16c2303d5c36e0ee

                Version:  6 1.4 – MD5: 569c4a7a0309477c7b17fb549b4a956a

                Version:  7 1.5 – MD5: f6c0409fffa4a8f5ca6b4f444bae297c

                Version:  8 1.6 – MD5: df32f9d5ff0572a8f40d8d9edadb1968

                Version:  9 1.7 – MD5: 61f0c2e4eaa49dd49c43f2caef83b1bf

6.       com.likegaming.ror           

                Version:  9 MD5: 7238fc5f14bdee958c7b41b13d6f3ca8

                Version: 10 MD5: 69820ddcab4fe0c6ff6a77865abf30b9

7.       com.uberspot.a2048mk

    Version: 19 1.96 - MD5: 72ba0eef80e7abe28ff8ab40ffb301d2



If each victim has been subscribed to at least one premium-rated number that charges a minimum $0.5 per SMS each month, the total financial losses could amount to $250,000 and more.

Considering the malware has been built with convert capabilities to operate completely silent on the victim’s Android device, user detection and removal is extremely difficult. To this end, a mobile security solution needs to be installed on the device to identify malicious applications – regardless from where they have been downloaded – and block threats from causing irreparable financial harm or personal data loss.

At the time of writing, Google has been notified of the existence of these malicious apps in Google Play. 

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...