{"id":15513,"date":"2012-04-13T13:55:12","date_gmt":"2012-04-13T20:55:12","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=15513"},"modified":"2025-05-27T21:43:04","modified_gmt":"2025-05-28T04:43:04","slug":"android-malware-promises-video-while-stealing-contacts","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-promises-video-while-stealing-contacts\/","title":{"rendered":"Android Malware Promises Video While Stealing Contacts"},"content":{"rendered":"

Recently we discovered a new Android Trojan in the official Google Play market that displays a video downloaded from the Internet–but only if some sensitive information is previously sent to a remote server. The malicious applications are designed for Japanese users and display \u201ctrailers\u201d of upcoming video games for Android. Here’s one example:<\/p>\n

\"\"<\/a><\/p>\n

Or anime\/adult Japanese videos:<\/p>\n

\"\"
\nSensitive Information Prone to Malware<\/h2>\n

When the application is about to be installed, two suspicious permissions–read contact data and read phone state and identity–are requested. Neither is needed for the principal purpose of the application, which is to display a video from the Internet. The reason for these requests becomes clear because the first action that the malware takes when it executes is to obtain, in the background, the following sensitive information from the device without the user\u2019s consent:<\/p>\n