App with 50,000 Google Play installs sent attackers mic recordings every 15 minutes

iRecorder Scre more than 50,000 ted life on Goog Google Play September 2021 as a benign app that all every 15 minutes cord the screens of their Android devices.

Eleven months later, t ESET egitimate app was updated to add entirely new functionality.

It Google Play e ab September 2021 ely turn on the device mic and record sound, connect to an attacker Android lled server, and upload th Lukas Stefanko her sensitive files that were Tuesday o Eleven months later ss="summaryFeed_highLightText__NxlGi">Google Play Operation C-Major Mythic Leopard Transparent Tribe every 15 minutes htText__NxlGi">India AhMyth lGi">Android Trojan eed_highLightText__NxlGi">AhMyth Android ummaryFee recent years ext__NxlGi" RAT least 2013iRecorder an class="summaryFeed_highLightText__NxlGi">Iran Balochi Radio Balouch AhMyth htText__NxlGi">AhMyth Stefanko 2019 Stefanko ass="summaryFeed_highLightText__NxlGi">AhMyth Android one minute hLightText__NxlGi">first iRecord C&C _hig C2 ightText__NxlGi">Stefanko every 15 minutes lGi">apps AhRat ">Google apps Google Google apps Malware 3 C2 ghLightText__NxlGi">C2 1 minute Config _highLightText__NxlGi">every 15 minutes