400+ Million Downloads Infected: The Shocking Spread of the SpinOk Android Malware

Photo Source - Google

Over 100 Android apps with more than 400 million downloads combined have been infected with a new malware strain called 'SpinOk'.

[{"selector":"#anim-3f571a77-368b-4f4b-8937-dd81bbec57ee","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8053ef89-d64b-4501-be06-6ea2c1a2b003","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9a77c2f0-63cf-4288-9d4e-f7ed90403230","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-60d75624-247c-4a4d-90c1-a6745f8b64e2","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

SpinOk is considered spyware because it steals private data and sends it to a remote server controlled by hackers.

[{"selector":"#anim-f73c88e0-8144-4b8d-97e1-2ca533ed8264","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-32f8c224-f34d-495d-bb33-3608227d1c47","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-34cba411-0fbb-4e15-a498-50bedaca90fb","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-0cb9d09a-ac17-4c56-b257-028fb8cb5c58","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

App developers added the SpinOk module to their apps, using minigames to provide users with "daily rewards."

[{"selector":"#anim-c2eb1401-3c3f-4960-abbc-04bc0c3126f4","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d30d60c6-7d38-42c7-bade-f5919c7ceb15","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ffbba48e-26bb-46aa-af45-608966487e09","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1ef1366b-77b5-4f82-8a18-dfe011264104","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

Malware attacks remain a common tool in the online world, as hackers exploit vulnerabilities to steal sensitive information or money.

[{"selector":"#anim-a29e0dc2-a2d0-49bc-83f3-846048d3ad42","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-426ac8fb-6612-4787-8dff-705eb2c149e5","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5bd3adf9-6c4c-49e8-b4ec-cbe628f1cb80","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-354d918e-4006-48e9-a8f9-a2c008bbbfdf","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

Dr. Web and Bleeping Computer discovered the spyware SpinOk in more than a hundred apps on the Google Play Store.

[{"selector":"#anim-0b933674-6f65-4432-be2e-dce9b773691a","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8e809bcf-aa34-44b2-8e71-c452df77fff9","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-f5fffd61-28fe-4776-b946-51582ed3d6b7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1b97480a-bcf5-4609-a099-69ad3f33d678","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

The infected apps have been downloaded a total of 400 million times.

[{"selector":"#anim-e8a2791b-d8fe-4069-b757-04f6a7bb9051","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-ca60b7a9-e7e2-47e8-8824-3dca960328fa","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-43ef23b1-4afa-4ed0-90ad-a3b365c149d8","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-654e052b-d05b-4b0f-83d6-dee4ec0507b6","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

Users should delete these apps immediately or update them to the latest version.

[{"selector":"#anim-a02d514a-d3f3-4144-88f0-8eee6b461258","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-289f5dc6-c387-4a59-91dd-eb5e459a4c9a","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-6768e6dd-9057-403b-ba12-6f9653114471","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-1edd0c81-6836-4bd4-be9c-ba47cea2eaf8","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

SpinOk performs malicious activities such as listing files, searching for specific files, and uploading files.

[{"selector":"#anim-9b3e270a-245c-4bac-a2de-6cc3b081751f","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-920f611a-ffcb-47f7-9da3-9432681c2316","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-710daad6-a34b-4b35-b8d6-a2bd1748df38","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d5f71c23-cb89-4d45-a6ac-d7610b3647ef","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google

It is unclear whether the publishers included the trojanized SDK intentionally or were tricked by a third party.

[{"selector":"#anim-2ad7fbe5-b89d-4295-8a97-ccb127f3dbe4","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-31ad89a4-8fd9-4d03-8298-302a439bc254","keyframes":{"transform":["translate3d(90.99999%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-9b62814f-d184-4429-8b96-05d0805f14e7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-a1b17d3c-1e1d-454a-b440-2fb39dbfe74b","keyframes":{"transform":["translate3d(116.27119%, 0px, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Photo Source - Google