The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.

Dark Reading Staff, Dark Reading

April 10, 2021

2 Min Read

APKPure, a popular alternative hub to download Android apps, was infected with malware that could be used to download Trojans to other Android devices, Kaspersky researchers report.

Google Play is the most official Android app store; however, it's only available on devices that use Google Mobile Services (GMS) and are tied to Google's infrastructure. Some vendors avoid GMS libraries because they want to be independent; they can because Android is an open OS.

This means those vendors lose access to Google Play, where most people go to install Android apps. Enter alternative stores like APKPure, which hosts only free or shareware apps. APKPure's owners say the apps in its shop are all clean and scanned by Google; however, researchers found the APKPure app itself wasn't quite as safe.

It seems APKPure version 3.17.18 was fitted with an advertisement SDK that had an embedded Trojan dropper. When launched, the Trojan runs a payload that can show ads on the lock screen, open browser tabs, collect device information, and most significantly, download other malware onto Android devices. The Trojan downloaded depends on the version of Android running.

Kaspersky shared their findings with APKPure on April 8 and received a response one day later indicating a fix was in the works. A new version (3.17.19) appeared on APKPure shortly after.

Read Kaspersky's full blog post and technical writeup for more details.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights