Reliance Jio has become the biggest brand in the country since it began commercial mobile telephony in 2016. The brand has built its reputation as a data-first network in India. Since its debut, the mobile data consumption has skyrocketed to a new level due to free data offer from the operator. Jio’s success has also led to rise of number of spam and phishing application. Cybersecurity firm Symantec has found 152 fake Android apps posing as Reliance Jio applications.
The security firm found that these apps had 21 different package names claiming to offer free daily data of 25GB. There were also packages offering 125GB data with validity ranging from one day to a year. These apps made such claims in order to generate advertising revenue for their developers. Symantec also found that these apps were installed on more than 39,000 mobile devices between January and June of this year. These apps claimed to provide different offers but they all share a few commonalities aimed to trick users.
Reliance Jio similar App icons and UI
The researchers note that these malicious app has logos similar to that of MyJio app. The apps (Jio 4G offers and Jio Prime) also had names that were generally variations of the original app. With names similar to the original app, the researchers found that these apps were successfully able to trick Android users in installing them. Symantec notes that the similarities don’t end at name or app icon. These malicious apps reportedly also borrow the user interface (UI) from the original MyJio app.
False Progress
These apps also tried to pretend that they offer free data to their users. Those who download these apps are asked to fill in their mobile numbers so that the free data offer can be activated. According to MediaNama, Symantec researchers observed that the app took them to a screen saying connecting to Jio users regardless of validity of the number. The app’s source code reveals that there was no real connection or processing taking place. The developers of these apps added a sleep timer to extend the time spent on this screen. After some time, the users get a message saying their number of eligible for free data offer. The app has been found successful in fooling users into believing that they are getting free data from Reliance Jio.
Share the app
As part of its trickery, these apps also ask users to share the app with 10 WhatsApp contacts. This is being done as part of the activation process. Some apps have been found to ask their users to follow the developer’s Instagram account or a Telegram group. Some apps were found sending SMS containing a link to download malicious app to the users’ contacts.
Advertisements
These apps are doing such trickery with a primary intent of making money. These apps rely on display advertisements where users are asked to click to unlock the offer. Some apps were found to open advertisement web pages. Some apps reportedly opened advertisement web-pages non-stop resulting in a loop of web pages.
Fake apps and Play Store affinity
Google Play Store has become a home for malicious and counterfeit applications. A number of malicious apps designed to generate advertising revenue have been found on the Play Store. In June, a two-year long cybersecurity study found there were at least 2,040 counterfeit apps on the Play Store. Google removed about 57 fake apps in February after Quick Heal highlighted these applications.
Malware researcher Lukas Stefanko spotted 15 GPS-based apps in the Play Store duping Android users and earn money from them. Researchers last week found more than 1,300 Android apps gathering location data even when permission was denied. Google said it will fix the issue with Android Q release later this year. All of these issues have now become a systemic problem that Google needs to address sooner than later.
Google Maps can now show you bike sharing docks with real-time updates 