{"id":46130,"date":"2022-04-07T11:04:00","date_gmt":"2022-04-07T11:04:00","guid":{"rendered":"http:\/\/d74eea85-8e1d-49be-a42c-9335fde48830"},"modified":"2022-04-07T11:04:00","modified_gmt":"2022-04-07T11:04:00","slug":"thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/","title":{"rendered":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" class=\"ff-og-image-inserted\"><\/div>\n<p>Six phony anti-virus apps have been removed from the Google Play app store because instead of protecting users from cyber criminals, they were actually being used to deliver malware to steal passwords, bank details and other personal information from Android users.&nbsp;<\/p>\n<p>The <a href=\"https:\/\/www.zdnet.com\/article\/what-is-malware-everything-you-need-to-know-about-viruses-trojans-and-malicious-software\/\" target=\"_blank\" rel=\"noopener\">malware<\/a> apps have been<a href=\"https:\/\/blog.checkpoint.com\/2022\/04\/07\/android-banking-stealer-dubbed-sharkbot-found-disguised-as-legitimate-anti-virus-apps-on-the-google-play-store\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\"> detailed by cybersecurity researchers at Check Point<\/a>, who say they were downloaded from Google&#8217;s official app marketplace by over 15,000 users who were looking to protect their devices, which instead became infected with <a href=\"https:\/\/www.zdnet.com\/article\/new-banking-trojan-sharkbot-makes-waves-across-europe\/\" target=\"_blank\" rel=\"noopener\">Sharkbot Android malware<\/a>.&nbsp;<\/p>\n<p>Sharkbot is designed to steal usernames and passwords, which is does by luring victims into entering their credentials in overlayed windows which sends the information back to the attackers, who can use it to gain access to emails, social media, online banking accounts and more.&nbsp;<\/p>\n<p>The six malicious apps found by researchers aimed to attract Android users searching for antivirus, cleaner and security apps.<\/p>\n<p><strong>SEE:&nbsp;<\/strong><a href=\"https:\/\/www.zdnet.com\/topic\/cybersecurity-lets-get-tactical\/#link=%7B%22linkText%22:%22Cybersecurity:%20Let's%20get%20tactical%20(ZDNet%20special%20report)%22,%22target%22:%22_blank%22,%22href%22:%22https:\/\/www.zdnet.com\/topic\/cybersecurity-lets-get-tactical\/%22,%22role%22:%22standard%22,%22absolute%22:%22%22%7D%23link=%7B%22role%22:%22standard%22,%22href%22:%22https:\/\/www.zdnet.com\/topic\/cybersecurity-lets-get-tactical\/%23link=%7B%22linkText%22:%22Cybersecurity:%20Let's%20get%20tactical%20(ZDNet%20special%20report)%22,%22target%22:%22_blank%22,%22href%22:%22https:\/\/www.zdnet.com\/topic\/cybersecurity-lets-get-tactical\/%22,%22role%22:%22standard%22,%22absolute%22:%22%22%7D%22,%22target%22:%22%22,%22absolute%22:%22%22,%22linkText%22:%22%3Cstrong%3ECybersecurity:%20Let's%20get%20tactical%20(ZDNet%20special%20report%3C\/strong%3E%22%7D\"><strong>Cybersecurity: Let&#8217;s get tactical<\/strong><\/a><strong>&nbsp;(ZDNet special report)<\/strong><\/p>\n<p>It&#8217;s possible that victims were sent <a href=\"https:\/\/www.zdnet.com\/article\/what-is-phishing-how-to-protect-yourself-from-scam-emails-and-more\/\" target=\"_blank\" rel=\"noopener\">phishing links<\/a> which directed them to the download pages for the Sharkbot infested apps. The apps were able to bypass Google Play store protections because malicious behaviour in the apps wasn&#8217;t activated until after they&#8217;d been downloaded by a user and the app has communicated back to servers run by the attackers.&nbsp;<\/p>\n<p>&#8220;We think that they were able to do it because all malicious actions were triggered from the C&amp;C server, so the app could stay in the &#8220;OFF&#8221;-state during a test period in Google Play and turn &#8220;ON&#8221; when they get to the users&#8217; devices,&#8221; Alexander Chailytko cyber security, research and innovation manager at Check Point Software told ZDNet.&nbsp;<\/p>\n<p>According to analysis of the malware, Sharkbot won&#8217;t infect everyone who downloads it \u2013 it uses a geofencing feature to identify and ignore users from China, India, Romania, Russia, Ukraine or Belarus. Meanwhile, most victims who downloaded Sharkbot appear to be in the United Kingdom and Italy.&nbsp;<\/p>\n<p>After identifying the apps, Check Point disclosed the findings to Google, which has removed the six apps from the Google Play Store. While the Sharbot-infected apps have been removed from Google&#8217;s official marketplace, they remain actively available on third-party sites, so users could still potentially be tricked into downloading them. ZDNet has asked Google for comment and will update this story if we get a response.<\/p>\n<p>Anyone who suspects they&#8217;ve downloaded a malicious app should immediately uninstall it, download a legitimate antivirus program to scan their device, and change any passwords on accounts that could&#8217;ve been stolen. If there&#8217;s any uncertainty about what to download or if an app is legitimate, looking at user reviews can help provide a clearer picture as if the app isn&#8217;t legitimate, reviews will often say so. &nbsp;<\/p>\n<p><strong>CYBERSECURITY<\/strong><\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/these-android-users-wanted-to-protect-their-phones-from-hackers-instead-they-downloaded-malware\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Users looking to protect their smartphone from hackers found their devices infected with Sharkbot malware.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-46130","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-07T11:04:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play\",\"datePublished\":\"2022-04-07T11:04:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/\"},\"wordCount\":488,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0e82d47f84137865f0ca583d2073bc8611cbdb49\\\/2022\\\/04\\\/07\\\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\\\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/\",\"name\":\"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0e82d47f84137865f0ca583d2073bc8611cbdb49\\\/2022\\\/04\\\/07\\\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\\\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"datePublished\":\"2022-04-07T11:04:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0e82d47f84137865f0ca583d2073bc8611cbdb49\\\/2022\\\/04\\\/07\\\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\\\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/0e82d47f84137865f0ca583d2073bc8611cbdb49\\\/2022\\\/04\\\/07\\\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\\\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/","og_locale":"en_US","og_type":"article","og_title":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-04-07T11:04:00+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play","datePublished":"2022-04-07T11:04:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/"},"wordCount":488,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/","url":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/","name":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","datePublished":"2022-04-07T11:04:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/0e82d47f84137865f0ca583d2073bc8611cbdb49\/2022\/04\/07\/da79e17f-a778-4e2d-a66d-66e56aa02a4f\/getty-a-woman-using-a-smartphone-in-the-kitchen.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/thousands-of-android-users-downloaded-this-password-stealing-malware-disguised-as-anti-virus-from-google-play\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Thousands of Android users downloaded this password-stealing malware disguised as anti-virus from Google Play"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46130"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46130\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}