Govt Issues Security Alert Against Malicious Apps on Google Play Store

The National Telecommunication and Information Security Board (NTISB) under the Cabinet Division has issued a cybersecurity advisory alerting all federal ministries, divisions, and the general public about the presence of malicious mobile applications on the Google Play Store. The advisory warns that several apps, which were identified and removed by Google, posed significant threats to user privacy and device security.

According to the advisory, the malicious applications included those linked to KoSpy spyware and the Anatsa (TeaBot) banking trojan. These apps were disguised as utility tools such as Phone Manager, File Manager, Smart Manager, Kakao Security, and Software Update Utility, which appeared legitimate but were designed to collect sensitive user data.

The KoSpy spyware is reportedly attributed to North Korean threat groups APT-37 (ScarCruft) and APT-43 (Kimsuky), and is capable of harvesting SMS messages, call logs, audio recordings, screenshots, location data, and files.

The advisory notes that Anatsa, also known as TeaBot, was distributed through apps posing as file managers and document readers. Its primary target was users of banking applications, from whom it attempted to steal login credentials and financial information. With over 220,000 downloads before being taken down, the advisory highlights the widespread impact and threat posed by this banking trojan.

According to the advisory, users should immediately delete any identified malicious apps from their devices and only download applications from trusted sources. It also advises verifying the legitimacy of apps before installation and avoiding those that request excessive or suspicious permissions. Enabling Google Play Protect is recommended as an added layer of security to detect and block harmful software automatically.

The NTISB has directed all concerned departments, organizations, and users to share the advisory widely and ensure the implementation of necessary cybersecurity measures.