This Popular Android App Spread Malware to Millions of Users – But Are iPhones Safe?

Google has pulled a popular PDF scanning app with millions of users from the Google Play Store after security researchers found that it was deploying and spreading malware.

The app, CamScanner, has been around since 2010 and has been downloaded more than 100 million times.

It’s a simple app that lets users scan PDF documents and it’s apparently pretty good at it, with around 1.8 million mostly positive reviews.

But according to Russian cybersecurity firm Kaspersky, the app was recently found to be spreading malware to Android devices.

Specifically, the malware was a malicious ad dropper component delivered by way of an advertising library within the app. Once on a device, the trojan dropper can deliver payloads from a malicious server.

That results in the attackers being able to use an infected device “to their benefit in any way they see fit.” That could result in intrusive ads being displayed, or even money being stolen by signing users up for fraudulent in-app subscriptions.

Kaspersky notes that the malicious component appears similar to modules that were found to be preinstalled on certain Chinese-made smartphones. But it appears to be a result of CamScanner using a malicious ad library (the malware was seemingly removed in more recent updates to the app).

The researchers alerted Google to the malware, who promptly removed the app. The iOS version of CamScanner remains available on Apple’s App Store.

Protecting Your iPhone

If you’re an iPhone user and reading this, you may think you’re safe from malware. And, truth be told, iOS is a much harder system to compromise.

Apple has a much more stringent app review process, so it catches most malicious apps before they’re on the App Store. Additionally, iOS’s security and sandboxing mechanisms ensure that apps can’t do that much damage even if they are malicious.

But that doesn’t mean that malicious apps are unheard of, or that rogue platforms on the App Store can’t compromise your security or privacy.

Some apps could bypass the app review process via side-loading. Other apps can trick you into making in-app purchases or spy on your data.

While the App Review Process and iOS stop most of these threats, the best defense against the ones that leak through is to stay vigilant. Only download apps that you absolutely trust and don’t install anything suspicious on your iOS device.