{"id":37717,"date":"2020-11-23T07:00:42","date_gmt":"2020-11-23T12:00:42","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=37717"},"modified":"2022-10-18T08:09:11","modified_gmt":"2022-10-18T12:09:11","slug":"minecraft-mod-adware-google-play","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/37717\/","title":{"rendered":"Malware in Minecraft mods"},"content":{"rendered":"<p>The first version of <em>Minecraft<\/em> was released way back in 2009, but the game <a href=\"https:\/\/www.theverge.com\/2020\/5\/18\/21262045\/minecraft-sales-monthly-players-statistics-youtube\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">remains incredibly popular<\/a> to this day. That should come as no surprise; not only is it <a href=\"https:\/\/www.kaspersky.com\/blog\/best-tablet-games-for-kids\/9985\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">enormous fun<\/a>, but it\u2019s a platform for kids and adults alike to create their own worlds. Some even use it for <a href=\"https:\/\/www.dezeen.com\/2017\/07\/03\/minecraft-designed-public-space-more-than-25-developing-countries-un-habitat-block-by-block\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">urban planning<\/a> \u2014 and some teachers use it <a href=\"https:\/\/www.theverge.com\/21377192\/minecraft-education-edition-back-to-school-pandemic\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">in the classroom<\/a>.<\/p>\n<p>Unfortunately, as with any successful project, cybercriminals are eager for a piece of the action. Since July of this year, we have detected more than 20 apps on Google Play claiming to be modpacks for <em>Minecraft<\/em>, when in fact their primary purpose is to display ads on smartphones and tablets in an extremely intrusive manner. We explain what these apps are and how to protect Android devices against such threats.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kisa-generic-2\">\n<h2>Fake Minecraft mods on Google Play<\/h2>\n<p>At the time of this writing, most of the unscrupulous apps we found on Google Play had already been removed. The five that remained were:<\/p>\n<ul>\n<li>Zone Modding Minecraft,<\/li>\n<li>Textures for Minecraft ACPE,<\/li>\n<li>Seeded for Minecraft ACPE,<\/li>\n<li>Mods for Minecraft ACPE,<\/li>\n<li>Darcy Minecraft Mod.<\/li>\n<\/ul>\n<p>The humblest of them had more than 500 installations, and the most popular more than 1 million. Although the apps have different publishers, two of the fake modpacks carried almost the exact same description, down to the typos.<\/p>\n<div id=\"attachment_37783\" style=\"width: 2110px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094239\/minecraft-mod-adware-google-play-screen-1-scaled.jpg\"><img decoding=\"async\" aria-describedby=\"caption-attachment-37783\" class=\"size-full wp-image-37783\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094239\/minecraft-mod-adware-google-play-screen-1-scaled.jpg\" alt=\"Apps with different publishers, same description\" width=\"2100\" height=\"2560\"><\/a><p id=\"caption-attachment-37783\" class=\"wp-caption-text\">Apps with different publishers, same description<\/p><\/div>\n<p>The app reviews are contradictory. Average ratings hover around the 3-star mark, but overall, scores are highly polarized, mostly 5s and 1s. That kind of spread suggests that bots are leaving rave reviews but real users are very unhappy. Unfortunately, in this case, the cybercriminals are targeting kids and teenagers, who may not pay attention to ratings and reviews before installing an app.<\/p>\n<div id=\"attachment_37784\" style=\"width: 2170px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094249\/minecraft-mod-adware-google-play-screen-2.jpg\"><img decoding=\"async\" aria-describedby=\"caption-attachment-37784\" class=\"size-full wp-image-37784\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094249\/minecraft-mod-adware-google-play-screen-2.jpg\" alt=\"The apps receive either five stars or one. Suspicious!\" width=\"2160\" height=\"2160\"><\/a><p id=\"caption-attachment-37784\" class=\"wp-caption-text\">The apps receive either five stars or one. Suspicious!<\/p><\/div>\n<p>We informed Google about the malicious apps mentioned above, and the apps were deleted from Google Play by the time this post was published. Nevertheless, it\u2019s worth mentioning that:<\/p>\n<ul>\n<li>After apps are deleted from Google Play, they remain on the smartphones of any users who already installed them;<\/li>\n<li>The malware creators can try to get their apps back in the store by modifying them and publishing them from a different developer\u2019s account.<\/li>\n<\/ul>\n<h2>Fake mods on the device<\/h2>\n<p>Meanwhile, users rightly curse the apps for not doing what they promised. Having landed on a smartphone, the \u201cmodpack\u201d lets itself be opened once, but it doesn\u2019t load any mods (in fact, the app we studied closely did nothing useful at all). The frustrated user closes the app, which promptly vanishes. More precisely, its icon disappears from the smartphone\u2019s menu.<\/p>\n<div id=\"attachment_37785\" style=\"width: 2570px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094300\/minecraft-mod-adware-google-play-screen-3-scaled.jpg\"><img decoding=\"async\" aria-describedby=\"caption-attachment-37785\" class=\"size-full wp-image-37785\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2020\/11\/20094300\/minecraft-mod-adware-google-play-screen-3-scaled.jpg\" alt=\"Users complain that the app doesn't work and seemingly deletes itself\" width=\"2560\" height=\"1276\"><\/a><p id=\"caption-attachment-37785\" class=\"wp-caption-text\">Users complain that the app doesn\u2019t work and seemingly deletes itself<\/p><\/div>\n<p>Because the \u201cmodpack\u201d seemed glitchy from the start, most users, especially kids and teens, won\u2019t waste time looking for it. They may even forget it and not bother trying to remove it. Unbeknownst to the user, however, the app remains on the smartphone \u2014 and not merely there, but hard at work.<\/p>\n<p>Concealed from the user, the fake modpack starts displaying ads. The sample we examined automatically opened a browser window with ads every two minutes, greatly interfering with normal smartphone use.<\/p>\n<p>In addition to the browser, the apps can open Google Play and Facebook or play YouTube videos, depending on the C&amp;C server\u2019s orders. Whatever the case, the constant stream of full-screen ads makes the phone practically unusable.<\/p>\n<h2>How to remove malicious Minecraft modpacks<\/h2>\n<p>Perhaps the most annoying thing about the fake Minecraft mods is that their victims have a very hard time figuring out why their browser (or Google Play, or Facebook, or YouTube) keeps opening. They are likely to conclude that the problem lies in the browser (or whichever app the fake modpack loads). However, uninstalling and reinstalling the browser will not fix the issue, and neither will tinkering with settings.<\/p>\n<p>The only way to defeat the problem is to get rid of the malicious app. But that means locating it, which may be tricky; affected users may not remember what exactly they installed before their phones started acting up. After identifying the malicious app, you\u2019ll need to find it in device settings (<em>Settings \u2192 Apps and notifications \u2192 Show all apps<\/em>) and delete it from there. Fortunately, the misbehaving modpacks get removed entirely with deletion and do not try to restore themselves.<\/p>\n<p>If you\u2019re having trouble figuring out which app is to blame for the smartphone\u2019s odd behavior, or you just want to clean your child\u2019s gadget quickly and easily, install a reliable security solution and scan the device. For example, <a href=\"https:\/\/www.kaspersky.com\/mobile-security?icid=gl_kdailyplacehold_acq_ona_smm__onl_b2c_kdaily_wpplaceholder_sm-team___kisa____da04049114cf37d2\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky for Android<\/a> recognizes fake Minecraft modpacks with the verdict not-a-virus:HEUR:AdWare.AndroidOS.HiddenAd.os, and prompts the user to delete any that are already on the smartphone or tablet.<\/p>\n<p>For the future, to prevent your child from downloading malware, teach them about the potential dangers of apps, including ones on Google Play. In particular, focus on poorly written descriptions and wildly varying ratings and reviews \u2014 warning signs the developer or publisher might not be on the up-and-up. And just to repeat, be sure to install a <a href=\"https:\/\/www.kaspersky.com\/mobile-security?icid=gl_kdailyplacehold_acq_ona_smm__onl_b2c_kdaily_wpplaceholder_sm-team___kisa____da04049114cf37d2\" target=\"_blank\" rel=\"noopener nofollow\">mobile antivirus<\/a> utility on their smartphone.<\/p>\n<input type=\"hidden\" class=\"category_for_banner\" value=\"kisa-generic\">\n","protected":false},"excerpt":{"rendered":"<p>More than 20 apps on Google Play that promised cool Minecraft mods turned out to be malicious.<\/p>\n","protected":false},"author":2624,"featured_media":37719,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[572,105,109,288,647,183,89,3975,3976],"class_list":{"0":"post-37717","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-adware","9":"tag-android","10":"tag-apps","11":"tag-children","12":"tag-gamers","13":"tag-google-play","14":"tag-kids","15":"tag-minecraft","16":"tag-mods"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/37717\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/minecraft-mod-adware-google-play\/22125\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/17603\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/8760\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/23717\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/minecraft-mod-adware-google-play\/21835\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/minecraft-mod-adware-google-play\/20612\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/minecraft-mod-adware-google-play\/24286\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/minecraft-mod-adware-google-play\/23419\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/minecraft-mod-adware-google-play\/29501\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/minecraft-mod-adware-google-play\/9082\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/minecraft-mod-adware-google-play\/16007\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/minecraft-mod-adware-google-play\/16672\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/minecraft-mod-adware-google-play\/14208\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/minecraft-mod-adware-google-play\/25790\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/minecraft-mod-adware-google-play\/29625\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/minecraft-mod-adware-google-play\/26417\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/minecraft-mod-adware-google-play\/23101\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/minecraft-mod-adware-google-play\/28437\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/minecraft-mod-adware-google-play\/28254\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/gamers\/","name":"gamers"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/37717","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2624"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=37717"}],"version-history":[{"count":8,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/37717\/revisions"}],"predecessor-version":[{"id":45880,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/37717\/revisions\/45880"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/37719"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=37717"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=37717"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=37717"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}