New DressCode malware slips into more than 40 Google Play Store apps undetected
When most malware scares break out, Google has already been notified and added the necessary checks to Google Play’s automatic gatekeeper to ensure apps with the malware are denied entry. Unfortunately, not all malware is accounted for, and sometimes a few apps get through with some nasty code.
The latest such malware is being called DressCode which has been found in 40 apps available through Google Play (and over 400 apps if we’re talking about third-party sources). Check Point, the research firm who alerted Google about the malware, talks about it here:
Similar to Viking Horde, DressCode creates a botnet that uses proxied IP addresses, which Check Point researchers suspect were used to disguise ad clicks and generate false traffic, generating revenue for the attacker. A botnet is a group of devices controlled by hackers without the knowledge of their owners. The bots can be used for various reasons based on the distributed computing capabilities of all the devices. The larger the botnet, the greater its capabilities.
Once installed on the device, DressCode initiates communication with its command and control server. Currently, after the initial connection is established, the C&C server orders the malware to “sleep,” to keep it dormant until there’s a use for the infected device. When the attacker wants to activate the malware, he can turn the device into a socks proxy, rerouting traffic through it.
Google has already removed several of the affected apps from Google Play, and we’d be surprised if we went much longer without all of them eventually being zapped. Check ahead for the full list of package names to ensure none of them are on your device.
- com.dark.kazy.goddess.lp
- com.whispering.kazy.spirits.pih
- com.shelter.kazy.ghost.jkv
- com.forsaken.kazy.game.house
- com.dress.up.Musa.Winx.Stella.Tecna.Bloom.Flora
- com.dress.up.princess.Apple.White.Raven.Queen.Ashlynn.Ella.Ever.After.High
- com.monster.high.Dracubecca.freaky.Fusion.draculaura
- com.dress.up.Cerise.Hood.Raven.Queen.Apple.White.Ever.After.Monster.High
- com.ever.after.high.Swan.Duchess.barbie.game
- com.cute.dressup.anime.waitress
- com.rapunzel.naughty.or.nice
- guide.slither.skins
- clash.royale.guide
- guide.lenses.snapchat
- com.minecraft.skins.superhero
- com.catalogstalkerskinforminecraft_.ncyc
- com.applike.robotsskinsforminecraft
- com.temalebedew.modgtavformcpe
- com.manasoft.skinsforminecraftunique
- com.romanseverny.militaryskinsforminecraft
- com.temalebedew.animalskinsforminecraft
- com.temalebedew.skinsoncartoonsforminecraft
- com.str.carmodsforminecraft
- com.hairstyles.stepbystep.yyhb
- com.str.mapsfnafforminecraft
- com.weave.braids.steps.txkw
- mech.mod.mcpe
- com.applike.animeskinsforminecraftjcxw
- com.str.furnituremodforminecraft
- com.vladgamerapp.skin.editor.for_.minecraft
- ru.sgejko.horror.mv
- com.vladgamerapp.skins.for_.minecraft.girls
- com.zaharzorkin.cleomodsforgtasailht
- com.temalebedew.ponyskins
- com.my.first.date.stories
- com.gta.mod.minecraft.raccoon
- com.applike.hotskinsforminecraft
- com.applike.serversforminecraftpe
- com.zaharzorkin.pistonsmod
- wiki.clash.guide
- mobile.strike.guide
- prank.calling.app
- sonic.dash.guide