‘Dark Herring’: 470 apps, over 100 million downloads, millions of dollars scammed

‘Dark Herring’ malware facts:
1. ‘Dark Herring’ is a type of malware called fleeceware, it started being downloaded 2 years ago
2. Fleeceware is a type of malicious mobile application that overcharges users for basic app functionality
3. It involved about 470 apps in the Google Play store and third-party app stores
4. As of today, all the malicious applications were taken down from Google Play
5. They are still available for download on third-party app repositories
6. ‘Dark Herring’ was uncovered by researchers at the mobile security firm Zimperium
7. It involved direct billing payments on carriers’ invoices of $15 monthly on average

How to check if your phone is infected:
1. Check your phone bills for a recurring charge of roughly $15 monthly, most likely using the app’s name
2. Go to Zimperium’s complete list of apps involved in ‘Dark Herring’ and see if the app appears there
3. You need to double-check if the app has been taken out by the Google Play Store
4. To do so: in a browser type:
https://play.google.com/store/apps/details?id=[enter here the name of the package found on Zimperium’s page above-first column]
5. If you get a page saying “We’re sorry, the requested URL was not found on this server” then your device is infected
6. If your device is infected, simply un-install the app AND
7. Call your carrier to get rid of any future direct billing payments associated with the app, un-installing the app will not cancel future charges.

How to avoid this type of malware
Being a fleeceware, ‘Dark Herring’ avoided all antivirus app which made it hard for users to be suspicious. Here are a few rules to avoid being a victim of such a scam:
1. Never enter your phone number when an app asks you to create an account, it is most likely an illegitimate request (except for phone apps such as Viber, WhatsApp…)
2. In general, be very suspicious of any request that is beyond reasonable when using an app
3. Make sure your kids and not so tech savvy people in your family are also aware to never enter their own phone numbers in apps
4. Check your phone bill regularly

for more info go to: Zimperium’s blog page