{"id":23774,"date":"2013-04-09T11:07:52","date_gmt":"2013-04-09T18:07:52","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=23774"},"modified":"2025-08-11T23:43:10","modified_gmt":"2025-08-12T06:43:10","slug":"one-click-fraud-variant-on-google-play-in-japan-steals-user-data","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/one-click-fraud-variant-on-google-play-in-japan-steals-user-data\/","title":{"rendered":"One-Click Fraud Variant on Google Play in Japan Steals User Data"},"content":{"rendered":"

Last week McAfee Labs reported<\/a> a series of “one-click fraud” malware on Google Play in Japan. We have been monitoring this fraudulent activity and have found more than 120 additional variants on Google Play since the previous report. The malicious developers upload five or six applications per account using three to five accounts every night, even though almost all of the applications are quickly deleted from Google Play. In some cases the fraudsters upload the applications with few or no modifications to the previous ones, and in other cases they substantially modify images and descriptions. But the final behavior is always the same.<\/p>\n

Most of the variants of this malware have the same functionality, with only slight differences in their implementation code. They simply show the fraudulent web pages on the in-application web component or the device\u2019s browser.<\/p>\n

Malware Variants<\/h2>\n

McAfee has also found a variant of this family of malware with more dangerous features. This variant retrieves the device user\u2019s Google account name–the email address–as well as the phone number, and sends the information to the attacker\u2019s remote server.<\/p>\n

 <\/p>\n

\"Fig.1<\/p>\n

The application description page on Google Play.<\/p>\n

 <\/p>\n

This application, tv.maniax.p_urapane1, is a 16-piece slider-puzzle game consisting of pornographic images. It also plays movie files when the user completes the game.<\/p>\n

Unlike previous variants from this family of fraudulent malware, this application requires several permissions at installation that are usually unnecessary for this type of game:<\/p>\n