Google removed screen recorder app from Play Store for spying on its users

Malware removal from people’s phones has always been a challenge. Every time new security precautions are introduced, it seems like malware will soon figure out how to get around them. Despite Google’s ongoing efforts to remove harmful applications from the Play Store, one screen recorder app was still able to spy on its users almost a year after it was first released because of a malware-transforming update.

Users could record content from their screens with the iRecorder Screen Recorder app, which debuted on the Play Store in 2021. A little over a year later, the app received an upgrade that, according to an ESET analysis, included malware that could covertly capture and send audio.

The eavesdropping program employed code from AhMyth, a well-known open-source remote access Trojan (RAT), which was also used in other apps that were similarly sneakily uploaded to the Play Store in front of Google.

Malware wasn’t included in earlier versions of the software, and the update that added it to the screen recorder probably wouldn’t have been spotted. The biggest trick it pulls might be that the permissions required by the malware to carry out its nefarious activities overlap with the permissions required by the software to carry out its screen recording feature.

This analysis is a great illustration of how a seemingly innocent program may secretly turn malicious following an update. The researchers speculate that this strategy may have been used to increase a user base before releasing the malware, but they point out that they lack any proof of it.

Google is experimenting with new techniques to stop malware from getting onto users’ phones as Android 14 approaches. New safeguards against apps seeking to access people’s screens without permission are included in the early beta versions. Even if it wouldn’t always prevent viruses like this, it’s still a significant sign that Google is concerned about app security.