ESET Warns of Malicious Android App iRecorder on Google Play
ESET researchers have uncovered a malicious Android app, iRecorder - Screen Recorder, available on Google Play since August 2022. The app, downloaded over 50,000 times, harbors AhRat, a dangerous variant of the open-source AhMyth Android RAT. Users who updated to version 1.3.8 or later may have exposed their devices to this threat.
AhRat, based on AhMyth, can record audio and steal files, suggesting it might be part of an espionage campaign. The developer behind iRecorder is a malicious actor, but their identity remains unknown. The app was also found on alternative Android markets, and the developer has other apps on Google Play without malicious code.
Android users can protect themselves by keeping their devices updated. App hibernation, available on Android 11 and higher, can prevent malicious apps from functioning as intended. Notably, AhRat was only detected on Google Play and not elsewhere, indicating a targeted campaign. This is not the first time AhMyth-based malware has appeared on the official store, with a previous incident occurring in 2019.
ESET's discovery highlights the ongoing threat of malicious apps on official stores. Users are advised to be cautious when updating apps and to keep their devices up-to-date. The developer behind iRecorder remains at large, and further investigation is needed to identify and apprehend them.
Read also:
- InformationWarfare in the Modern Era: Enhancing an Information Strategy for today's Battlefield and Botnet Threats
- Ukraine's Drone Revolution: Rapid Evolution and Countermeasures
- EU's Energy Infrastructure Under Siege: Cyber Attacks Surge 67% in 2025
- Vito Schnabel's Art & Real Estate Fortune Tops €10.4M
