{"id":20978,"date":"2021-09-20T18:17:38","date_gmt":"2021-09-20T22:17:38","guid":{"rendered":"https:\/\/www.psafe.com\/en\/blog\/?p=20978"},"modified":"2022-04-27T14:00:38","modified_gmt":"2022-04-27T18:00:38","slug":"joker-malware-is-back-and-its-no-joke","status":"publish","type":"post","link":"https:\/\/www.psafe.com\/en\/blog\/joker-malware-is-back-and-its-no-joke\/","title":{"rendered":"Joker Malware is Back (And It\u2019s No Joke)"},"content":{"rendered":"

Old malware never dies \u2014 it just morphs into something more devious and dangerous \u2014 and this pattern is playing out with \u201cJoker\u201d malware, which was first identified in 2016. In 2021, it\u2019s back and more diverse and devious than ever.<\/span><\/p>\n

During the past few months, Joker has become one of the most active Android malware infections. Joker rides on the coat-tails of seemingly legitimate apps, then covertly signs up users for pricey subscription services. It can also steal SMS messages, contact lists, and device information.\u00a0<\/span><\/p>\n

Joker variations seem to arrive in batches, with a fresh batch leeching onto dozens of apps as recently as September.\u00a0<\/span><\/p>\n

Joker Infiltrates The App Store<\/b><\/p>\n

\u201cOne of the best ways to avoid malware and trojan apps is to use Google\u2019s sanctioned app store,\u201d says Emilio Simoni, PSafe\u2019s dfndr lab Research Director, \u201cbut unfortunately, Joker has managed to disguise itself and mutate so profusely, that it has found its way on to several apps within the official Google Play marketplace. Of course third party app stores are also offering Joker-tainted apps \u2014 so the best protection is going to be a strong security app that sniffs out malware-tainted apps immediately, like our dfndr security Pro.\u201d<\/span><\/p>\n

Google removes the offending apps as soon as they\u2019re reported \u2014 but the high rate of variation and concealment with this particular trojan keeps bringing new specimens on board.<\/span><\/p>\n

Delay Tactics<\/b><\/p>\n

\u201cPart of what makes Joker so effective is that it waits to take effect,\u201d Simoni remarks. \u201cAfter the trojan-app is downloaded (many of these are knockoffs of better-known apps) it waits to drop a very small packet of code, it then reaches out to the server that loads the malware that does all the dirty work.\u201d\u00a0<\/span><\/p>\n

What Can You Do To Stay Safe?<\/b><\/p>\n

Good hygiene with your digital devices includes:<\/span><\/p>\n