The popular financial aid application Android is actually dangerous malware

Researchers have found an application of predatory loans that hide as a financial management app
The Android app has appealed to the exclusive target of Indian users
Has been removed from the game store

Cyber security researchers found a spyloan app in Google Play targeting Indian consumers with about 100,000 discharges, before being drawn from the App Store.

Praining loan applications have a simple Modus operandi: I advertise as fast and easy loan applications, offering fast loans, without documents. However, when the victim installs the application, it requires excessive permissions, accessing people’s messages and calls of calls, contacts, photos and more.

After taking a loan, the application then requires high interest rates, begins to harass the victim and threaten to release sensitive photos (sometimes even false, edited photos).

Bypass security mechanisms with webview

In this case, Cyfirma researchers have found an application called Finance Simplified, which would have 100,000 downloads on Google Play before being eliminated. This application pretended to be a financial management application and, while it worked more or less as stipulated worldwide, has been behaved differently for users located in India.

Before the app is pulled, Bleepingcomputer managed to read some of the reviews. “The very very very large application, gave a small loan and black mail to pay another, otherwise the photos edited as an E -mail Black Em mail,” read a review. Cyfirma also said that the application was announced as a registered non-bank financial company, which was a direct lie.

Google is usually quite good on detection malware In his warehouse, which asks the question – how did the simplified financing succeed? Apparently loaded a web view to redirect users to an external website, where they downloaded a loan app hosted on a Amazon Ec2 server.

“The Finance Simplified app seems to target Indian users specifically by displaying and recommending loan applications, loading a web view showing a loan service that redirects to an external website, where a separate loan APK file is downloaded.” said Cyfirma.

After the news broke out, a Google spokesman said the app was removed from Google Play and added that Android users are “automatically protected” against known versions of this Google Play Protect malware. “Google Play Protect can warn users or block known applications to present malicious behavior, even when those applications come from sources outside the game,” said the spokesman Bleepingcomputer.