New Android malware silently infects billions of devices via Google

Overview of the Malware

A newly discovered malware strain is infecting Android devices, operating under the name 'Android Developer Verifier' (ADV). With full root privileges, it remains hidden in the background, waiting for an activation signal.

Scope of Infection

Estimations indicate that nearly 4 billion Android devices, which is about half of the global population, have been compromised.

Mechanism of Infection

ADV camouflages itself as a legitimate process and cannot be disabled or uninstalled by users. It is propagated through Google’s Play Protect service, ironically, which is supposed to safeguard users against malware.

Purpose of the Malware

The primary function of ADV is to prevent users from running software from developers who have not received central approval from Google. This poses significant risks to user autonomy and software diversity on the platform.

Implications for Developers and Users

The threat raises concerns over Google’s approach to regulating Android software. While aimed at reducing malware distribution, the strategy has been criticized for imposing unnecessary restrictions on developers and undermining user choice. Alternatives have been suggested, including improvements to Play Protect's app scrutiny.