The worse offender in the report is an app called SuperVPN Free VPN Client which has been installed over 100 million times.
Users of the virtual private network (VPN) could find personal details such as credit cards, photos and private conversations are put at risk due to an attack called man-in-the-middle.
These vulnerabilities can allow hackers to easily intercept all the communications between the user and the VPN provider, letting the hackers see everything the user is doing.
Speaking on its blog, Jan Youngren from VPN Pro said: “The implications here are pretty dire. Based on our research, more than 105 million people could right now be having their credit card details stolen, their private photos and videos leaked or sold online, every single minute of their private conversations recorded and sent to a server in a secret location. They could be browsing a fake, malicious website set up by the hacker and aided by these dangerous VPN apps.”
READ MORE: Fresh Android WARNING – Delete these popular apps now or pay a high price
This warning was published last Monday, February 24, but despite the seriousness of the claims this app and many more all remain available to download.
What makes this worse is some of the latest reviews of SuperVPN Free VPN Client aren’t exactly glowing.
Speaking on the Play Store, one Android fan said: “It Contains lots of ads. Which is not a big problem as it’s a free app. But it contains some sexual ads, vulgar ads, inappropriate ads. Some are skippable, some are not. Unskippable vulgar ads are super annoying especially when you are in a public place.”
And another added: “Rates an F – solely because developer allows adult site ads.”
It’s unclear why the app is still allowed on the Play Store but it might be due to the fact it doesn’t violate Google’s strict rules.
Express.co.uk has contacted Google to find out if SuperVPN Free VPN Client will remain on its store but we are yet to hear back. Until then it might be worth downloading this application with care.
Google is trying hard to stop the endless attacks on its Play Store with its new Play Protect service aimed at stopping rogue apps from attacking devices.
According to a recent update from the US tech firm’s security team, it appears that threats are being uploaded to the Play Store on an almost daily basis with one attack, known as Bread, designed specifically to attempt to slip into the Play Store undetected.
Google says it first started tracking Bread (also known as Joker) in early 2017, identifying apps created solely for SMS fraud.
Since then, a total of 1,700 unique Bread apps have been found and removed from the Play Store making it a huge challenge to stop.
In a post on its blog, Google said: “Sheer volume appears to be the preferred approach for Bread developers. At different times, we have seen three or more active variants using different approaches or targeting different carriers. Within each variant, the malicious code present in each sample may look nearly identical with only one evasion technique changed.
“At peak times of activity, we have seen up to 23 different apps from this family submitted to Play in one day. At other times, Bread appears to abandon hope of making a variant successful and we see a gap of a week or longer before the next variant. This family showcases the amount of resources that malware authors now have to expend. Google Play Protect is constantly updating detection engines and warning users of malicious apps installed on their device.”
Google’s new Play Protect monitoring is clearly working as many of these dangerous apps were taken offline before anyone had managed to access them.