Check your phone! Apps caught sending data to China

July 7, 2023

By Kim Komando

Another day, another bad app. Cybersecurity researchers at Pradeo spotted two apps in the Google Play Store collecting and sending data straight to malicious servers based in China. Combined, they have 1.5 million downloads. Is one on your phone?

Look for these names

• File Recovery and Data Recovery (com.spot.music.filedate): Over 1 million installs.
• File Manager (com.file.box.master.gkd): Over 500,000 installs.

Both are supposed to be file managers. In reality, they’re spyware apps that collect a lot of info and send it to over 100 destinations, most located in China.

In the Play Store, both apps claimed they don’t collect data. Uh, they lied. Oh, and there’s no way to delete or request deletion of that data, either.

Collected data includes:

• Contacts stored in the device and connected accounts like email and social media.
• Pictures, audio files and videos.
• GPS location.
• Network provider, plus the phone’s operating system and model info.

Stay vigilant

The scary thing is you can’t always spot malware. It can hide in apps that seem completely legit — or even apps that WERE safe to use and then compromised. In this case, though, there were a couple of giveaways.

• The apps asked for all these permissions upon download. Don’t mindlessly click through and accept when looking for a new app. Look through the list of permissions and determine whether it’s really worth giving that up.
• They had a ton of downloads and very few reviews. Bad sign! Anything popular will have its fair share of good and bad reviews.
• They disappeared from the home screen. This is a sneaky tactic malicious apps rely on. Everything seems normal, then the icon for the app is nowhere to be found. The best case for the shady developer is you forget you downloaded this junk, and it stays hard at work mining your data.

Was one of these apps on your phone? Sorry, friend, but it’s time to do a factory reset. It’s a bit of a pain, but there’s no getting around it once you download malware.