{"id":211142,"date":"2025-03-24T21:01:12","date_gmt":"2025-03-25T04:01:12","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=211142"},"modified":"2025-07-29T17:46:56","modified_gmt":"2025-07-30T00:46:56","slug":"new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/","title":{"rendered":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps"},"content":{"rendered":"<p><span data-contrast=\"auto\">Cybercriminals are getting smarter. They\u2019re now using a development toolkit called <\/span><b><span data-contrast=\"auto\">.NET MAUI<\/span><\/b><span data-contrast=\"auto\"> to create fake apps that look and feel like the real thing\u2014banking apps, dating apps, and even social media. But instead of helping you, these apps secretly steal your private info.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">We break down <a href=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-android-malware-campaigns-evading-detection-using-cross-platform-framework-net-maui\">the full research from McAfee Labs<\/a> here:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"1012\" data-end=\"1057\">What Is .NET MAUI and Why Should You Care?<\/h2>\n<p><span data-contrast=\"auto\">.NET MAUI is a tool used by developers to build apps that work on many devices\u2014like phones, tablets, and computers\u2014all from one set of code.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">That\u2019s great for app creators. But now, <\/span><b><span data-contrast=\"auto\">hackers are using it too<\/span><\/b><span data-contrast=\"auto\">. While McAfee is able to detect this malware, the decision to build with .NET MAUI helps hide their dangerous code from most antivirus software. Think of it like a thief wearing an invisibility cloak\u2014unless you\u2019re really looking, you won\u2019t see them.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"1522\" data-end=\"1554\">How These Fake Apps Trick You<\/h2>\n<h3 data-start=\"1556\" data-end=\"1582\">1. <strong data-start=\"1563\" data-end=\"1582\">They Look Legit<\/strong><\/h3>\n<p><span data-contrast=\"auto\">Hackers are creating apps that look like they\u2019re from real companies. For example, one fake app pretended to be <\/span><b><span data-contrast=\"auto\">IndusInd Bank<\/span><\/b><span data-contrast=\"auto\">, asking users to enter sensitive information like:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Full name<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Phone number<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Email<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">Birthdate<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"5\" data-aria-level=\"1\"><span data-contrast=\"auto\">Credit card information<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"4\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"6\" data-aria-level=\"1\"><span data-contrast=\"auto\">Unique tax and personal identifiers (PAN and Aadhaar)<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Once you hit submit, that info goes straight to the hacker\u2019s server.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p data-start=\"1837\" data-end=\"1905\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-211020 size-medium\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.51.30-PM-134x300.png\" alt=\"\" width=\"134\" height=\"300\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.51.30-PM-134x300.png 134w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.51.30-PM-457x1024.png 457w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.51.30-PM-58x129.png 58w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.51.30-PM.png 604w\" sizes=\"auto, (max-width: 134px) 100vw, 134px\" \/><\/p>\n<p style=\"text-align: center;\" data-start=\"1837\" data-end=\"1905\"><em><strong>Figure 1. Fake IndusInd Bank app&#8217;s screen requesting user information<\/strong> <\/em><\/p>\n<h3 data-start=\"1907\" data-end=\"1947\">2. <strong data-start=\"1914\" data-end=\"1947\">They Hide the Dangerous Stuff<\/strong><\/h3>\n<p data-start=\"1949\" data-end=\"2183\"><span class=\"TextRun SCXW221053218 BCX0\" lang=\"EN-GB\" xml:lang=\"EN-GB\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW221053218 BCX0\">Normal Android apps have code in a <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW221053218 BCX0\">format security tools<\/span><span class=\"NormalTextRun SCXW221053218 BCX0\"> can scan. These fake apps <\/span><\/span><span class=\"TextRun MacChromeBold SCXW221053218 BCX0\" lang=\"EN-GB\" xml:lang=\"EN-GB\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW221053218 BCX0\">hide their code in<\/span><span class=\"NormalTextRun SCXW221053218 BCX0\"> binary <\/span><span class=\"NormalTextRun SCXW221053218 BCX0\">files<\/span><\/span><span class=\"TextRun SCXW221053218 BCX0\" lang=\"EN-GB\" xml:lang=\"EN-GB\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW221053218 BCX0\"> so it <\/span><span class=\"NormalTextRun SCXW221053218 BCX0\">can\u2019t<\/span><span class=\"NormalTextRun SCXW221053218 BCX0\"> be easily detected. That lets them stay on your phone longer\u2014stealing quietly in the background.<\/span><\/span><span class=\"EOP SCXW221053218 BCX0\" data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"2190\" data-end=\"2231\">Malware Example: Fake Social Media App<\/h2>\n<p><span data-contrast=\"auto\">In another case, hackers made an app that pretended to be a social media platform. This one <\/span><b><span data-contrast=\"auto\">targeted Chinese-speaking users<\/span><\/b><span data-contrast=\"auto\"> and was even trickier than the fake bank app.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Here\u2019s what it did:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Stole contacts, photos, and texts<\/span><\/b><span data-contrast=\"auto\"> from the phone<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Used a <\/span><b><span data-contrast=\"auto\">3-stage process<\/span><\/b><span data-contrast=\"auto\"> to hide its code<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Encrypted everything<\/span><\/b><span data-contrast=\"auto\"> so it\u2019s harder to track<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">Used <\/span><b><span data-contrast=\"auto\">weird, fake app permissions<\/span><\/b><span data-contrast=\"auto\"> to confuse security scanners<\/span><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">And instead of using regular internet traffic, it sent stolen data through secret encrypted channels\u2014so even if someone intercepted it, they couldn\u2019t read it.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p data-start=\"2650\" data-end=\"2808\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-211125\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-1024x329.png\" alt=\"\" width=\"1024\" height=\"329\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-1024x329.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-300x96.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-768x246.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-1536x493.png 1536w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM-205x66.png 205w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2025\/03\/Screen-Shot-2025-03-21-at-12.59.17-PM.png 1776w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p style=\"text-align: center;\" data-start=\"2650\" data-end=\"2808\"><em><strong><span class=\"TextRun MacChromeBold SCXW202811841 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW202811841 BCX0\" data-ccp-parastyle=\"caption\">Figure 2. Various fake apps using the same technique<\/span><\/span><\/strong><\/em><\/p>\n<h2 data-start=\"2815\" data-end=\"2851\">Where Are These Apps Coming From?<\/h2>\n<p data-start=\"2853\" data-end=\"2938\">These apps <strong data-start=\"2864\" data-end=\"2900\"><span style=\"text-decoration: underline;\">aren\u2019t in the Google Play Store<\/span>.<\/strong> Instead, hackers are sharing them on:<\/p>\n<ul data-start=\"2940\" data-end=\"3012\">\n<li data-start=\"2940\" data-end=\"2955\">Fake websites<\/li>\n<li data-start=\"2956\" data-end=\"2972\">Messaging apps<\/li>\n<li data-start=\"2973\" data-end=\"3012\">Sketchy links in texts or chat groups<\/li>\n<\/ul>\n<p data-start=\"3014\" data-end=\"3115\">So if someone sends you a link to a cool new app that\u2019s not from the Play Store\u2014<strong data-start=\"3094\" data-end=\"3115\">be extra careful.<\/strong><\/p>\n<h2 data-start=\"3122\" data-end=\"3148\">How to Protect Yourself<\/h2>\n<p data-start=\"3150\" data-end=\"3188\">Here are a few easy ways to stay safe:<\/p>\n<ul>\n<li data-start=\"3190\" data-end=\"3654\"><strong data-start=\"3192\" data-end=\"3239\">Download apps only from official app stores<\/strong> like Google Play or the Apple App Store<\/li>\n<li data-start=\"3190\" data-end=\"3654\"><strong data-start=\"3284\" data-end=\"3347\">Avoid clicking on links from strangers or untrusted sources<\/strong><\/li>\n<li data-start=\"3190\" data-end=\"3654\"><strong data-start=\"3352\" data-end=\"3381\">Install security software<\/strong> like <a href=\"https:\/\/www.mcafee.com\/en-us\/identity-theft\/protection.html?path=blogs\" target=\"_new\" rel=\"noopener\" data-start=\"3387\" data-end=\"3449\">McAfee+<\/a> to catch threats in real-time<\/li>\n<li data-start=\"3190\" data-end=\"3654\"><strong data-start=\"3484\" data-end=\"3523\">Keep your apps and software updated<\/strong>\u2014updates often fix security holes<\/li>\n<li data-start=\"3190\" data-end=\"3654\"><strong data-start=\"3561\" data-end=\"3586\">Check app permissions<\/strong>\u2014if a flashlight app wants access to your texts, that\u2019s a red flag<\/li>\n<\/ul>\n<p data-start=\"3700\" data-end=\"3836\">Hackers are getting creative, but you can stay one step ahead. These new .NET MAUI-based threats are sneaky\u2014but they\u2019re not unstoppable.<\/p>\n<p data-start=\"3838\" data-end=\"3929\">With smart habits and the right tools, you can keep your phone and your personal info safe. <strong data-start=\"3936\" data-end=\"3980\">Want real-time protection on your phone? <\/strong><a href=\"https:\/\/www.mcafee.com\/en-us\/identity-theft\/protection.html?path=blogs\" target=\"_new\" rel=\"noopener\" data-start=\"3983\" data-end=\"4054\">Download McAfee+<\/a> and get ahead of the latest threats.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and&#8230;<\/p>\n","protected":false},"author":1407,"featured_media":159126,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1838],"tags":[],"coauthors":[15735],"class_list":["post-211142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-25T04:01:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-30T00:46:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jasdev Dhaliwal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jasdev Dhaliwal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\"},\"author\":{\"name\":\"Jasdev Dhaliwal\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/49b8ff7075f52333a95710a8340c326f\"},\"headline\":\"New Android Malware Sneaks Past Security by Pretending to Be Real Apps\",\"datePublished\":\"2025-03-25T04:01:12+00:00\",\"dateModified\":\"2025-07-30T00:46:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\"},\"wordCount\":576,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg\",\"articleSection\":[\"Mobile Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\",\"name\":\"New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg\",\"datePublished\":\"2025-03-25T04:01:12+00:00\",\"dateModified\":\"2025-07-30T00:46:56+00:00\",\"description\":\"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Mobile Security\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/mobile-security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"New Android Malware Sneaks Past Security by Pretending to Be Real Apps\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/49b8ff7075f52333a95710a8340c326f\",\"name\":\"Jasdev Dhaliwal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/25b6fc7c367684ebf6f6144e3dde58e6\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/MePortrait-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/MePortrait-96x96.jpg\",\"caption\":\"Jasdev Dhaliwal\"},\"description\":\"Jasdev is a Director of Marketing at McAfee and a specialist in consumer security and online privacy. With over 10 years of security industry experience, he is a regular writer on the current security landscape and likes to educate others on how to keep themselves, their families, and their homes safe online.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/jasdhaliwal\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/jasdev-dhaliwal\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog","description":"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog","og_description":"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real","og_url":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2025-03-25T04:01:12+00:00","article_modified_time":"2025-07-30T00:46:56+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg","type":"image\/jpeg"}],"author":"Jasdev Dhaliwal","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Jasdev Dhaliwal","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/"},"author":{"name":"Jasdev Dhaliwal","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/49b8ff7075f52333a95710a8340c326f"},"headline":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps","datePublished":"2025-03-25T04:01:12+00:00","dateModified":"2025-07-30T00:46:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/"},"wordCount":576,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg","articleSection":["Mobile Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/","url":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/","name":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg","datePublished":"2025-03-25T04:01:12+00:00","dateModified":"2025-07-30T00:46:56+00:00","description":"Cybercriminals are getting smarter. They\u2019re now using a development toolkit called .NET MAUI to create fake apps that look and feel like the real","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/09\/300x200_Blog_phonetracking.jpg","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/new-android-malware-sneaks-past-security-by-pretending-to-be-real-apps\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Mobile Security","item":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/"},{"@type":"ListItem","position":3,"name":"New Android Malware Sneaks Past Security by Pretending to Be Real Apps"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/49b8ff7075f52333a95710a8340c326f","name":"Jasdev Dhaliwal","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/25b6fc7c367684ebf6f6144e3dde58e6","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/MePortrait-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/MePortrait-96x96.jpg","caption":"Jasdev Dhaliwal"},"description":"Jasdev is a Director of Marketing at McAfee and a specialist in consumer security and online privacy. With over 10 years of security industry experience, he is a regular writer on the current security landscape and likes to educate others on how to keep themselves, their families, and their homes safe online.","sameAs":["https:\/\/www.linkedin.com\/in\/jasdhaliwal\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/jasdev-dhaliwal\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/211142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/1407"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=211142"}],"version-history":[{"count":4,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/211142\/revisions"}],"predecessor-version":[{"id":211226,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/211142\/revisions\/211226"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/159126"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=211142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=211142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=211142"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=211142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}