August 23, 2021 5 min read

The Belgian Police warned about the return of the ‘Joker’ virus , which attacks Android devices and hides itself in various applications on the Google Play Store . This malware is capable of subscribing the user to payment services without their authorization and emptying their bank accounts without them noticing.

“This malicious program has been detected in eight Play Store applications that Google has suppressed,” say the Belgian authorities in a statement published this Friday on their website.

The ‘Joker’ malware became famous in 2017 for infecting and robbing its victims by hiding in different applications. Since then, the Google Play Store defense systems have removed around 1,700 apps with the ‘Joker’ malware before they were downloaded by users.

In September 2020, the ‘Joker’ virus was found in 24 Android applications that registered more than 500 thousand downloads before being removed. It is estimated that that time it affected more than 30 countries including the United States, Brazil and Spain. Through unauthorized subscriptions, hackers could steal up to $ 7 (about 140 Mexican pesos) per subscription weekly, a figure that has most likely increased in recent months.

How does the Joker virus work in Android apps?

The ‘Joker’ Trojan virus belongs to a family of malware known as Bread , whose objective is to hack cell phone bills and authorize operations without the user’s consent.

Researchers from the cybersecurity company Quick Heal Security Lab, cited in the statement, explain that this virus can enter text messages , contacts and other information on the infected smartphone.

What makes this malware more dangerous is its ability to subscribe the affected Android user to paid services , usually Premium or the most expensive version, without their prior authorization.

In the beginning, apps infected with ‘Joker’ or another Malware from this family carried out fraud via SMS , but then began to attack online payments . These two techniques take advantage of the integration of telephone operators with vendors, to facilitate the payment of services with the mobile bill . Both require verification of the device, but not the user, thus they manage to automate payments without requiring any user interaction.

#FinanzasPersonales The excess of streaming platforms, apps, online services and others, they make a hole in your portfolio. See how to do a subscription ‘detox’ to have a healthier monthly budget and take care of your money. https://t.co/8hX4qDIY3P

– Entrepreneur in Spanish (@SoyEntrepreneur) August 23, 2021

“You risk a big surprise at the end of the month in your bank account or on your credit card,” said the Belgian police, referring to the unknown charges that the victim will see at the end of the month.

In fact, it is very common for those affected by ‘Joker’ to become aware of the theft until they review their account statement in detail. This is because the bank does not suspect an apparently ‘normal’ subscription and, generally, the charges are so small that they are not detected as unusual movements, so they do not even send a usage alert to the account holder.

In which Android apps could the ‘Joker virus be?

On this occasion, the harmful applications that the Google Play Store eliminated after detecting that they contained the ‘Joker’ virus are:

• Auxiliary Message
• Element Scanner
• Fast Magic SMS
• Free CamScanner
• Go Messages
• Super Message
• Super SMS
• Travel Wallpapers

However, other specialists warn that more apps are affected and, therefore, millions of users who do not know that they are already victims of this cyber fraud.

The cybersecurity company Zscaler, cited by La Razón , made public the names of 16 other apps that, according to their analysis, also contain this malicious code:

• Private SMS
• Hummingbird PDF Converter – Photo to PDF
• Style Photo Collage
• Talent Photo Editor – Blur focus
• Paper Doc Scanner
• All Good PDF Scanner
• Care Message
• Part Message
• Blue Scanner
• Direct Messenger
• One Sentence Translator – Multifunctional Translator
• Mint Leaf Message-Your Private Message
• Unique Keyboard – Fancy Fonts & Free Emoticons
• Tangram App Lock
• Desire Translate
• Meticulous Scanner

Of course, the recommendation for Andriod users is to check if they have any of these apps installed on their smartphone and delete them immediately, since the fact that they are deleted from the Google Play Store does not imply automatic uninstallation from the computers where they were downloaded.