{"id":206849,"date":"2024-12-18T09:32:12","date_gmt":"2024-12-18T17:32:12","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=206849"},"modified":"2025-06-05T18:55:32","modified_gmt":"2025-06-06T01:55:32","slug":"spyware-distributed-through-amazon-appstore","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/","title":{"rendered":"Spyware distributed through Amazon Appstore"},"content":{"rendered":"<p style=\"font-weight: 400;\"><em>Authored by Wenfeng Yu and ZePeng Chen<\/em><\/p>\n<p style=\"font-weight: 400;\">As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive and sophisticated. Recently, we uncovered a seemingly harmless app called \u201cBMI CalculationVsn\u201d on the Amazon App Store, which is secretly stealing the package name of installed apps and incoming SMS messages under the guise of a simple health tool. McAfee reported the discovered app to Amazon, which took prompt action, and the app is no longer available on Amazon Appstore.<\/p>\n<p style=\"font-weight: 400;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-206850\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1.jpg\" alt=\"\" width=\"283\" height=\"582\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1.jpg 934w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1-146x300.jpg 146w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1-498x1024.jpg 498w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1-768x1579.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1-747x1536.jpg 747w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure1-63x129.jpg 63w\" sizes=\"auto, (max-width: 283px) 100vw, 283px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 1. Application published on Amazon Appstore<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"font-weight: 400;\"><strong>Superficial Functionality: Simple BMI Calculation<\/strong><\/h2>\n<p style=\"font-weight: 400;\">On the surface, this app appears to be a basic tool, providing a single page where users can input their weight and height to calculate their BMI. Its interface looks entirely consistent with a standard health application. However, behind this innocent appearance lies a range of malicious activities.<\/p>\n<p style=\"font-weight: 400;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-206955 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture2.png\" alt=\"\" width=\"274\" height=\"534\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture2.png 274w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture2-154x300.png 154w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture2-66x129.png 66w\" sizes=\"auto, (max-width: 274px) 100vw, 274px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 2. Application MainActivity<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"font-weight: 400;\"><strong>Malicious Activities: Stealing Private Data<\/strong><\/h2>\n<p style=\"font-weight: 400;\">Upon further investigation, we discovered that this app engages in the following harmful behaviors:<\/p>\n<ol>\n<li><strong>Screen Recording:<\/strong> The app starts a background service to record the screen and when the user clicks the \u201cCalculate\u201d button, the Android system will pop up request screen recording permission message and start screen recording. This functionality is likely to capture gesture passwords or sensitive data from other apps. In the analysis of the latest existing samples, it was found that the developer was not ready for this function. The code did not upload the recorded mp4 file to the C2 server, and at the beginning of the startRecording() method, the developer added a code that directly returns and does not execute follow code.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-206970 \" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture3.png\" alt=\"\" width=\"681\" height=\"467\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture3.png 843w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture3-300x206.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture3-768x527.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture3-188x129.png 188w\" sizes=\"auto, (max-width: 681px) 100vw, 681px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 3. Screen Recorder Service Code<\/p>\n<p>&nbsp;<\/p>\n<p style=\"font-weight: 400;\">When the recording starts, the permission request dialog will be displayed.<\/p>\n<p style=\"font-weight: 400;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-206985\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture4.png\" alt=\"\" width=\"294\" height=\"588\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture4.png 404w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture4-150x300.png 150w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Picture4-65x129.png 65w\" sizes=\"auto, (max-width: 294px) 100vw, 294px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 4. Start Recording Request.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"2\">\n<li><strong>Installed App Information:<\/strong> The app scans the device to retrieve a list of all installed applications. This data could be used to identify target users or plan more advanced attacks.<\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-206910\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure5-1.png\" alt=\"\" width=\"976\" height=\"722\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure5-1.png 976w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure5-1-300x222.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure5-1-768x568.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure5-1-174x129.png 174w\" sizes=\"auto, (max-width: 976px) 100vw, 976px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 5. Upload User Data<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"3\">\n<li><strong>SMS Messages:<\/strong> It intercepts and collects all SMS messages received on the device, potentially to capture one-time password (OTP), verification codes and sensitive information. The intercepted text messages will be added to Firebase (storage bucket: testmlwr-d4dd7.appspot.com).<\/li>\n<\/ol>\n<h2 style=\"font-weight: 400;\"><strong>Malware under development: <\/strong><\/h2>\n<p style=\"font-weight: 400;\">According to our analysis of historical samples, this malicious app is still under development and testing stage and has not reached a completed state. By searching for related samples on VirusTotal based on the malware&#8217;s package name (com.zeeee.recordingappz) revealed its development history. We can see that this malware was first developed in October 2024 and originally developed as a screen recording app, but midway through the app&#8217;s icon was changed to the BMI calculator, and the payload to steal SMS messages was added in the latest version.<\/p>\n<p style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-206925\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure6-1.png\" alt=\"\" width=\"480\" height=\"392\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure6-1.png 480w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure6-1-300x245.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure6-1-158x129.png 158w\" sizes=\"auto, (max-width: 480px) 100vw, 480px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 6. The Timeline of Application Development<\/p>\n<p>&nbsp;<\/p>\n<p style=\"font-weight: 400;\">The address of the Firebase Installation API used by this app uses the character &#8220;testmlwr&#8221; which indicates that this app is still in the testing phase.<\/p>\n<h2 style=\"font-weight: 400;\"><strong>App Developer Information:<\/strong><\/h2>\n<p style=\"font-weight: 400;\">According to the detailed information about this app product on the Amazon page, the developer&#8217;s name is: \u201cPT. Visionet Data Internasional\u201d. The malware author tricked users by abusing the names of an enterprise IT management service provider in Indonesia to distribute this malware on Amazon Appstore. This fact suggests that the malware author may be someone with knowledge of Indonesia.<\/p>\n<p style=\"font-weight: 400;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-206940\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7.jpg\" alt=\"\" width=\"316\" height=\"649\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7.jpg 934w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7-146x300.jpg 146w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7-498x1024.jpg 498w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7-768x1579.jpg 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7-747x1536.jpg 747w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/12\/Figure7-63x129.jpg 63w\" sizes=\"auto, (max-width: 316px) 100vw, 316px\" \/><\/p>\n<p style=\"font-weight: 400; text-align: center;\">Figure 7. Developer Information<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"font-weight: 400;\"><strong>How to Protect Yourself<\/strong><\/h2>\n<p style=\"font-weight: 400;\">To avoid falling victim to such malicious apps, we recommend the following precautions:<\/p>\n<ol>\n<li>Install Trusted Antivirus Apps: Use reliable antivirus software to detect and prevent malicious apps before they can cause harm.<\/li>\n<li>Review Permission Requests: When installing an app, carefully examine the permissions it requests. Deny any permissions that seem unrelated to its advertised functionality. For instance, a BMI calculator has no legitimate reason to request access to SMS or screen recording.<\/li>\n<li>Stay Alert: Watch for unusual app behavior, such as reduced device performance, rapid battery drain, or a spike in data usage, which could indicate malicious activity running in the background.<\/li>\n<\/ol>\n<h2 style=\"font-weight: 400;\"><strong>Conclusion<\/strong><\/h2>\n<p style=\"font-weight: 400;\">As cybercrime continues to evolve, it is crucial to remain vigilant in protecting our digital lives. Apps like \u201cBMI CalculationVsn\u201d serve as a stark reminder that even the simplest tools can harbor hidden threats. By staying alert and adopting robust security measures, we can safeguard our privacy and data.<\/p>\n<h3 style=\"font-weight: 400;\"><strong>IoC<\/strong><\/h3>\n<p style=\"font-weight: 400;\">Distribution website:<\/p>\n<ul>\n<li>hxxps:\/\/www.amazon.com\/PT-Visionet-Data-Internasional-CalculationVsn\/dp\/B0DK1B7ZM5\/<\/li>\n<\/ul>\n<p style=\"font-weight: 400;\">C2 servers\/Storage buckets:<\/p>\n<ul>\n<li>hxxps:\/\/firebaseinstallations.googleapis.com\/v1\/projects\/testmlwr-d4dd7<\/li>\n<li>hxxps:\/\/6708c6e38e86a8d9e42ffe93.mockapi.io\/<\/li>\n<li>testmlwr-d4dd7.appspot.com<\/li>\n<\/ul>\n<p style=\"font-weight: 400;\">Sample Hash:<\/p>\n<ul>\n<li>8477891c4631358c9f3ab57b0e795e1dcf468d94a9c6b6621f8e94a5f91a3b6a<\/li>\n<\/ul>\n<p style=\"font-weight: 400;\">\n","protected":false},"excerpt":{"rendered":"<p>Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps&#8230;<\/p>\n","protected":false},"author":695,"featured_media":200112,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4136],"class_list":["post-206849","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Spyware distributed through Amazon Appstore | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Spyware distributed through Amazon Appstore | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-12-18T17:32:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T01:55:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Spyware distributed through Amazon Appstore\",\"datePublished\":\"2024-12-18T17:32:12+00:00\",\"dateModified\":\"2025-06-06T01:55:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\"},\"wordCount\":782,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\",\"name\":\"Spyware distributed through Amazon Appstore | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png\",\"datePublished\":\"2024-12-18T17:32:12+00:00\",\"dateModified\":\"2025-06-06T01:55:32+00:00\",\"description\":\"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Spyware distributed through Amazon Appstore\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Spyware distributed through Amazon Appstore | McAfee Blog","description":"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Spyware distributed through Amazon Appstore | McAfee Blog","og_description":"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2024-12-18T17:32:12+00:00","article_modified_time":"2025-06-06T01:55:32+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Spyware distributed through Amazon Appstore","datePublished":"2024-12-18T17:32:12+00:00","dateModified":"2025-06-06T01:55:32+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/"},"wordCount":782,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/","name":"Spyware distributed through Amazon Appstore | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png","datePublished":"2024-12-18T17:32:12+00:00","dateModified":"2025-06-06T01:55:32+00:00","description":"Authored by Wenfeng Yu and ZePeng Chen As smartphones have become an integral part of our daily lives, malicious apps have grown increasingly deceptive","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2024\/09\/300x200_Blog_042723.png","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/spyware-distributed-through-amazon-appstore\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Spyware distributed through Amazon Appstore"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/206849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=206849"}],"version-history":[{"count":10,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/206849\/revisions"}],"predecessor-version":[{"id":215151,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/206849\/revisions\/215151"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/200112"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=206849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=206849"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=206849"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=206849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}