Over 60 Android Apps With 100 Million+ Downloads Infected By Goldoson Adware: Report

MCAFEE discovered a new threat named 'Goldoson' that affected 60+ apps with over 100 million downloads. A majority of these applications were listed on the Google Play Store. The discovered adware threat collects app list, history of Wi-Fi and Bluetooth and GPS locations. It can perform operations by clicking ads in the background without user permission.

The research squad at McAfee found these apps were live in ONE store(with 8 million downloads) and Google's Play Store in South Korea. Further, it reported the affected apps to Google. As a response, the tech giant stirred into action and notified developers. While some of these applications were removed, others were updated by their developers.

Some of the affected applications listed in a PhoneArena report include: L.POINT with L.PAY, Swipe Brick Breaker, Lotte Cinema, TMAP, Genie Music, Money Manager Expense & Budget, Cultureland version 2, GOM Player, Megabox, LIVE Score Real-Time score, Pikicast, Compass 9: Smart Compass, GOM Audio – (Music, Sync lyrics), TV – All About Video, Guninday, Item mania, LOTTE WORLD Magicpass, Bounce Brick Breaker, InfiniteSlice, Norae bang, SomNote – Beautiful note app, GoodTVBible, Happy Mobile Happy Screen, UBhind: Mobile Tracker Manager, Korea Subway Info: Metroid, Mafu Driving Free, Girl singer WorldCup, FSP Mobile, Catmera, Cultureland Plus, Simple Air, Audio Recorder, Lotteworld Seoul Sky, Snake Ball Lover, Play Geto, Memory Memo, PB Stream, Money Manager (Remove Ads), Inssaticon – Cute Emoticons, ECloud, SCinema, Ticket Office, Lotteworld Aquarium, Lotteworld Water Park, T map for KT-LGU+, Random number, AOG Loader, GOM Audio Plus – Music, Sync l, Swipe Brick Breaker 2, Safe Home, Chuncheon, Fantaholic, Cinecube, TNT, New Safe, Cashnote, Bestcare Health, InfinitySolitaire, TDI News, Eyesting, TingSearch, Krieshachu Fantastic and Yeonhagoogokka.

Goldoson registers the handset and retrieves "remote configurations" when the app runs. It also has the capability to "load web pages." Aggregated data is "sent out every two days." However, the duration may change depending on the remote configuration.

Further, the blog claims handsets running on Android 11 and above have stronger protection against the threat. Early signs of a virus in a phone are low battery backup, sudden dip in performance, frequent heating and increased internet data consumption.

It is a moment of concern for users who installed one of the listed apps. Updating to the latest version is highly recommended. You can check the app markets to see if any of these apps have been removed. If this is the case, consider uninstalling the app.