New Malware ‘Fleckpe’ on Android Installed 600k Times on Google Play

Android users have been warned to be on the lookout for the new malware, Fleckpe, which has been found on Google Play disguised as several legitimate apps.

The malware generates unauthorized charges by subscribing users to premium services without their knowledge.

Kaspersky, the cybersecurity company that discovered Fleckpe, says that it is the newest addition to a group of malicious Android malware that generate revenue for threat actors by subscribing users to premium services.

Fleckpe has been active since last year, but it was only recently discovered and documented.

Kaspersky has found 11 Fleckpe trojan apps that are impersonating image editors, photo libraries, and premium wallpapers on Google Play. The malware has been downloaded over 620,000 times and most of its victims are in Thailand, Malaysia, Indonesia, Singapore, and Poland.

However, a smaller number of infections have been found all over the globe.

How does the malware do the subscription without you knowing?

The malware requests access to notification content upon installation. This access is required to capture subscription confirmation codes on many premium services.

Once a Fleckpe app is launched, it decodes a hidden payload that contains malicious code which is then executed. The threat actors make money from the unauthorized subscriptions by receiving a share of the monthly or one-time subscription fees generated through the premium services. When the threat actors operate the services, they keep the entire revenue.

The apps that contain Fleckpe have been removed from Google Play, but Kaspersky warns that the malicious actors might have deployed other undiscovered apps, which could mean that the actual number of installations is higher. (GFB)