Google Play Store malware: Barcode Scanner app with 10+ million installs becomes malware after December 2020 update

Smartphone users are usually less suspicious of mobile apps that have millions of installs. Unfortunately, it was recently discovered that a very popular barcode scanning app with more than 10 million downloads eventually became malware.

Popular Barcode Scanner app becomes a malware

The app in question, simply named Barcode Scanner, was reportedly available on the Google Play Store for years. Some users have had it installed on their devices for a long time as well.

In a post on Malwarebytes blog, mobile malware researcher Nathan Collier reported that app users started to sound the alarm around December when ads frequently showed up “out of nowhere” through their default browser.

One Malwarebytes forums member named Anon00 eventually narrowed down the problem to a Barcode Scanner app. Upon further analysis, Collier reported that it appeared the app had been safe to use until after an update released sometime in December.

In-app ads have become very common over the years, especially with apps that are free to use. As the post explained, developers typically use an ads software development toolkit (SDK). When a mobile app eventually enforces over-the-top advertising activities, the change is usually applied through the SDK and not on the app’s code. But Malwarebytes reported this was not the case with the Barcode Scanner.

Last December, the said update is believed to have added a code that made the app into “a full on malware.” Collier reported, “Furthermore, the added code used heavy obfuscation to avoid detection.” The malware evaded the security measures of Google Play Protect, and it was not clear how long the app was able to remain undetected since it went rogue.

In a 50-second video demonstrating the replication of the malware execution, it appears that the intrusive ads show up unprompted. “This is different from web redirects that occur while actively browsing the web,” the security researcher added.

Android users confuse malware-infused app with another popular ‘Barcode Scanner’

Unfortunately, the blog post did not initially include a link to the malware-infected app. Many apps are simply named “Barcode Scanner” on the Google Play Store, and Android users thought the one developed by ZXing Team with more than 100 million installs was the malicious app being reported.

To clarify, ZXing Team’s product is a different app, and there is no report to suggest that it is not safe to use. The malware-infected app was developed by LAVABIRD LTD and used to be located in this link. It has been removed from the Google Play Store, but LAVABIRD LTD has four active apps on the Play Store as of this writing.

Featured photo by mohamed_hassan on Pixabay