Nowadays, security on our smartphones is increasingly complicated. Malware and viruses that can enter our phones can come from text messages, WhatsApp links, apps, or social networks. This is what happens with two apps that experts suggest removing from phones running the Android operating system. One is Wuta Camera, a photo app with more than 10 million downloads, and the other is Max Browser, a web browser with more than 1 million installations.
Necro Trojan allows attackers to remotely take control of a compromised system
These apps have been linked to the Necro Trojan, a type of malware designed to infect systems and perform various malicious actions. It’s a spyware that steals personal information and inserts hidden ads onto the device to generate revenue for its operators. Specifically, the Necro Trojan is a remote access Trojan (RAT) that allows attackers to remotely take control of a compromised system.
Necro infiltrates the system without the user even noticing, activating in the background
Necro typically exploits vulnerabilities in outdated software or applications. If a device or app has a security breach, Necro infiltrates the system without the user even noticing, activating in the background. According to the developers, only Wuta Camera versions 6.3.7.138 and later are malware-free. Therefore, if you’re reading this and have an older version, it’s recommended that you remove it as soon as possible.
Google has already removed Wuta Camera from the Play Store
Experts point out that these viruses can also reach the system through pirated programs or modified applications in which users request greater app customization or new features missing from the official versions. We’ve already discussed Wuta Camera, but as for Max Browser, experts recommend uninstalling it immediately, regardless of the version. Although Google has already removed it from the Play Store, it may still be installed on many devices. Furthermore, they lack official protection, and users unsuspectingly install them containing hidden malware.
The Necro Trojan was first discovered in 2019
As for Necro, if it manages to enter the system, it hides using obfuscation techniques, acting as an “obfuscated loader.” This means its code is complexly designed to be difficult for antivirus software to understand or detect. The Necro Trojan was first discovered in 2019, and what makes it particularly threatening is its use of steganography, a technique that hides malicious code within the app itself.
Using steganography allows to bypass standard security checks and go undetected while spying on your activity
Necro has also been detected in mods for instant messaging apps like WhatsApp. These often offer more features than the official versions and may be available on Google Play or third-party sites, and contain this type of malware. By using steganography, it allows it to bypass standard security checks and go undetected while spying on your activity, stealing data, or even manipulating what appears on your screen.
Recommendation to users: not downloading apps from unofficial sources
It’s important to keep in mind that cybersecurity companies recommend not downloading apps from unofficial sources, as this could open the door to malware like Necro. And it’s not just apps on Google Play. Unofficial versions of popular apps, such as GBWhatsApp, FMWhatsApp, or Spotify Plus, are also dangerous. When downloaded from unauthorized sites, they can easily hide malware without users noticing.
Ultimately, it’s important to review the sites from which we download new apps for our smartphones, since these days, mobile phones are where we store the most personal and professional information. And it’s very important not to look for mods or pirated versions. These apps are almost always packed with all kinds of Trojans: from harmless ones to mobile spyware. So, let’s be careful not to take downloading apps lightly.
