sensitive information theft

Recent findings indicate that certain Google Play apps and unofficial modifications of popular applications are being exploited to spread the Necro trojan malware, which can log keystrokes, steal sensitive information, install additional malware, and execute remote commands. The Necro trojan, first identified in 2019, was previously found in the PDF maker app CamScanner. A new version has been detected in the Wuta Camera app and Max Browser on the Google Play Store, both of which have since been removed by Google. Unofficial 'modded' versions of popular apps like Spotify and WhatsApp, often available on third-party websites, are also spreading the malware. These modified apps can contain malicious SDKs that trigger the trojan payload upon user interaction. The malware can download files, install applications, and subscribe users to paid services without consent. Users are advised to be cautious when downloading apps from third-party sources.