Malware hits millions of Android users — delete these apps right now

Green skull on smartphone screen.
(Image credit: Shutterstock)

Update August 1: There's a new report of auto-starting Android malware infecting millions of devices. And we have a list of more apps you'll want to delete. 

Another batch of malicious apps filled with adware and malware has managed to slip past Google’s defenses and end up on the Play Store.

In order to trick unsuspecting users into downloading them, these 36 malicious apps pose as image-editing tools, virtual keyboards, system optimizers, wallpaper changers and other useful tools. 

While these apps promise to add new functionality to your Android smartphone, they actually push intrusive ads, subscribe users to premium services and steal social media accounts instead, according to BleepingComputer.

The malicious apps were discovered by security researchers from the antivirus software maker Dr. Web who provided further insight on each of the individual apps in a new report.

Although Google has removed most of these bad apps from the Play Store, you will still need to uninstall them manually if you have any of them on your Android devices.

Delete these Android apps: Full list 

  • Photo Editor: Beauty Filter 
  • Photo Editor: Retouch & Cutout 
  • Photo Editor: Art Filters 
  • Photo Editor - Design Maker 
  • Photo Editor & Background Eraser 
  • Photo & Exif Editor 
  • Photo Editor - Filters Effects 
  • Photo Filters & Effects 
  • Photo Editor : Blur Image 
  • Photo Editor : Cut, Paste
  • Emoji Keyboard: Stickers & GIF
  • Neon Theme Keyboard 
  • Neon Theme - Android Keyboard 
  • Cashe Cleaner
  • FastCleaner: Cashe Cleaner
  • Call Skins - Caller Themes
  • Funny Caller 
  • CallMe Phone Themes
  • InCall: Contact Background 
  • MyCall - Call Personalization 
  • Caller Theme
  • Caller Theme 
  • Funny Wallpapers - Live Screen 
  • 4K Wallpapers Auto Changer
  • NewScrean: 4D Wallpapers
  • Stock Wallpapers & Backgrounds 
  • Notes - reminders and lists 

Adware apps that keep running in the background

Generic ads displayed on the screens of a generic smartphone and tablet.

(Image credit: BestForBest/Shutterstock)

In addition to just being annoying, adware apps can quickly drain your smartphone’s battery as many of them are designed to continue running in the background even after you close them.

The ones discovered by Dr. Web are actually modifications of existing adware families that first showed up on the Play Store back in May of this year.

These adware apps are also able to run on top of other apps as they request permission to use overlay windows during installation. However, they can keep running in the background as well by adding themselves to the battery saver’s exclusion list in Android.

To make matters worse, many of these adware apps also feature the ability to hide their app icons in the app drawer or replace them with a different icon that resembles a core system component such as “SIM Toolkit”.

Of these adware apps, Neon Theme Keyboard by Nataļja Kokorevičs (which is still up in the Play Store at the time of writing) stands out as it has over a million downloads even with a terrible score of 1.8 based on 4,000 reviews. Fortunately though, it does seem like Google Play Protect has begun warning users about the app based on reviews from the Play Store.

Joker apps that subscribe users to premium services

Dr. Web’s researchers also found malicious apps on the Play Store that infect users’ devices with the infamous Joker malware

These apps are particularly dangerous since this malware strain has the ability to sign up victims to premium subscription services without their knowledge. Unfortunately, two of the malicious apps in Dr. Web’s list (Water Reminder- Tracker & Reminder by YPC Dev and Yoga- For Beginner to Advanced by ALHASSAN) are still available to download and have yet to be removed from the Play Store.

Although both apps actually provide the functionality described in their Play Store listings, they also perform malicious actions in the background.

Image editing apps that steal your Facebook account

Facebook app on phone

(Image credit: Shutterstock)

Having your Facebook account hacked can be devastating, especially when it’s a Facebook Business account, which is why two of the malicious apps discovered by Dr. Web’s researchers need to be uninstalled immediately.

These two apps (YouToon – AI Cartoon Effect and Pista – Cartoon Photo Effect) disguise themselves as image editing tools that can apply cartoon filters over regular images and have been downloaded from the Play Store over 1.5 million times.

Both apps have been designed to steal data from your Android smartphone that can be used to hack into your Facebook account.

Protecting yourself from malicious apps on the Play Store

In order to avoid intrusive ads, being subscribed to premium services against your will or having your social media accounts stolen, the first thing you should do is look through the list above to make sure that none of these malicious apps are installed on your Android smartphone or tablet. 

If they are, remove them immediately and consider using one of the best Android antivirus apps to look for any viruses that may have been left behind.

At the same time, you should also avoid installing apps from unknown sources and instead download them from official stores like the Google Play Store, Amazon App Store or Samsung Galaxy App Store. 

Even then, bad apps do manage to slip past Google’s defenses from time to time which is why you should always check user reviews and ratings, visit developer websites and read the privacy policy of every app you install. I know it’s a lot but it’s worth doing if you want to be on the safe side.

Finally, you should ensure that Google Play Protect is active on your devices as it regularly checks for malicious apps and warns you if you try to install one.

Anthony Spadafora
Senior Editor Security and Networking

Anthony Spadafora is the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to password managers and the best way to cover your whole home or business with Wi-Fi. Before joining the team, he wrote for ITProPortal while living in Korea and later for TechRadar Pro after moving back to the US. Based in Houston, Texas, when he’s not writing Anthony can be found tinkering with PCs and game consoles, managing cables and upgrading his smart home.