Even the best Android apps can go rogue. Especially when injected with malicious code by hackers, which is exactly what happened with a popular screen recorder app on the Google Play Store.
According to a new report from the cybersecurity firm ESET, the app iRecorder – Screen Recorder which has been installed over 50,000 times, recently began serving up a remote access trojan (RAT) to unsuspecting users.
What makes this news particularly interesting is that the app itself was uploaded to the Play Store without any malicious functionality back in 2021. However, with the release of version 1.3.8 of iRecorder – Screen Recorder in August 2022, the app began infecting the best Android phones with malware.
Although the app has since been removed from the Play Store after ESET reported it to Google, you will still need to manually delete it from your smartphone if you have it installed.
Recording audio and stealing files
Newer versions of the iRecorder – Screen Recorder app contains a customized version of the open-source AhMyth Android Rat which ESET is now referring to as AhRat.
If installed on a user’s smartphone, this malware can record audio and then upload it to a command and control (C&C) server controlled by the hackers behind this campaign. However, it can also steal all sorts of files from a compromised device from photos and videos to documents and even saved web pages.
As ESET notes in its report, the malicious behavior exhibited by iRecorder – Screen Recorder suggests that the now malicious app is part of an espionage campaign. However, its researchers weren’t able to attribute the app to any particular group of cybercriminals or hackers.
How to stay safe when good apps go bad
Although the possibility of good apps going bad is a scary idea to wrap your head around, Google has already implemented preventive measures against these types of malicious actions in Android.
In Android 11 and up, the search giant’s mobile operating system contains a feature called App hibernation that places apps which have been dormant for several months into a state of hibernation. This resets all of the permissions they’ve been granted and prevents them from being used maliciously.
If you’re still worried though, you should consider installing one of the best Android antivirus apps as they constantly scan your smartphone for malware and other viruses. Google Play Protect does this as well and it comes pre-installed on every Android phone if you’re on a tight budget. However, many Android antivirus apps provide other security features too like a VPN or even a password manager.
iRecorder – Screen Recorder is the only app ESET has observed so far spreading the AhRat malware but there could be others in the future. This is why you always want to ensure your Android smartphone is up to date and running the latest version.