A popular app, "iRecorder – Screen Recorder," has been found to be infected with malicious software, according to cybersecurity firm ESET.
The app, which had thousands of downloads from Google's app store, was designed to collect microphone recordings and other files from the user's phone. The app has since been removed from the store but had already been downloaded over 50,000 times.
ESET discovered that the app, initially launched in September 2021 without harmful features, introduced a malicious code named AhRat in an update almost a year later. AhRat is a modified version of the open-source Remote Access Trojan (RAT) called AhMyth, which grants full access to the victim's device and functions as spyware and stalkerware.
The code allowed the app to upload a minute of ambient sound from the phone's microphone every 15 minutes and transfer documents, web pages, and media material from the user's phone.
Lukas Stefanko, a security researcher at ESET, explained that the app's nature made it easier for the malicious code to operate within its already defined permission model.
Stefanko believes that the malicious code is likely part of a larger espionage campaign, sometimes on behalf of governments or for financial reasons. Despite efforts from Google and Apple to screen apps for malware, harmful apps can sometimes slip through. The person or entity behind planting the malicious code in the iRecorder app remains unknown.
If you have already installed this app, you are strongly advised to delete it from your device immediately.
