16 apps with malware & Wireless Application Protocol billing fraud delisted from Google Play

Security researchers on the ThreatLabZ team at Zscaler Cloud Security have published a report detailing that 17 apps on the Google Play Store were infected with the infamous Joker (Bread) malware.

The report describes the malware as designed to steal text messages, contacts, device info, and utilizing stored payment info to sign up for premium wireless access point services.

The 17 apps include the following:

• All Good PDF Scanner • Blue Scanner • Care Message • Desire Translate • Direct Messenger • Hummingbird PDF Converter - Photo to PDF • Meticulous Scanner • Mint Leaf Message • One Sentence Translator - Multifunctional Translator • Paper Doc Scanner • Part Message • Private SMS • Style Photo Collage • Talent Photo Editor - Blur focus • Tangram App Lock • Unique Keyboard - Fancy Fonts & Free Emoticons

All together, these apps were downloaded a total of 120,000 times. Once the Zscaler team informed Google of the vulnerabilities, the apps were immediately removed from the Play Store.

The team concludes its report by recommending that you pay close attention to the permissions you give apps when you install them on your Android device even if they are downloaded from a trusted source such as the Google Play Store. In particular, it's recommended that you read up on any apps that request or require access to call logs, contacts, text messages, or other potentially sensitive information.

Further coverage: Zscaler Cloud Security ZDNet