--- title: Two spyware tied with China found hiding on the Google Play Store description: This week, our engine detected two spyware hiding on the Google Play Store and affecting up to 1.5 million users. image: https://blog.pradeo.com/hubfs/pirate-anonyme-utilise-malware-telephone-portable-pour-pirater-donnees-personnelles-argent-comptes-bancaires-concept-cybercriminalite.jpg --- [![pradeo\_logo\_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [Security Alert](https://blog.pradeo.com/topic/security-alert) # Two spyware tied with China found hiding on the Google Play Store ![Picture of Roxane Suau](https://blog.pradeo.com/hubfs/roxane-suau.jpg) By [Roxane Suau](https://blog.pradeo.com/author/roxane-suau) on July, 6 2023 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![](https://blog.pradeo.com/hubfs/pirate-anonyme-utilise-malware-telephone-portable-pour-pirater-donnees-personnelles-argent-comptes-bancaires-concept-cybercriminalite.jpg) This week, our engine detected two spyware hiding on the Google Play Store and affecting up to 1.5 million users. Both applications are from the same developer, pose as file management applications and feature similar malicious behaviors. They are programmed to launch without users’ interaction, and to silently exfiltrate sensitive users’ data towards various malicious servers based in China. We have alerted Google of the discovery before publishing this alert.   ## How to identify these spyware?   File Recovery and Data Recovery - com.spot.music.filedate - 1M+ Installs [File Manager](https://play.google.com/store/apps/details?id=com.file.box.master.gkd) - com.file.box.master.gkd - 500K+ Installs     ![file reco](https://blog.pradeo.com/hs-fs/hubfs/file%20reco.png?width=392&height=320&name=file%20reco.png) ![file manager](https://blog.pradeo.com/hs-fs/hubfs/file%20manager.png?width=365&height=320&name=file%20manager.png) ## Breached data: From contacts lists to all media… On the Google Play Store, both the above-mentioned applications’ profiles announce that they do not collect any data from users’ devices, which we found to be false information. Furthermore, they announce that if data was collected, users could not request it to be deleted, which is against most data protection laws like the GDPR.                                            ![MicrosoftTeams-image (2)-1](https://blog.pradeo.com/hs-fs/hubfs/MicrosoftTeams-image%20(2)-1.png?width=444&height=221&name=MicrosoftTeams-image%20(2)-1.png)   The reports from our behavioral analysis engine show that both spyware collect very personal data from their targets, to send them to a large number of destinations which are mostly located in China and identified as malicious. Stolen data include: - Users’ contact lists from the device itself and from all connected accounts such as email, social networks… - Media compiled in the application: Pictures, audio and video contents - Real time user location - Mobile country code - Network provider name - Network code of the SIM provider - Operating system version number, which can lead to vulnerable system exploit like the Pegasus spyware did - Device brand and model Specifically, each application performs more than a hundred transmissions of the collected data, an amount that is so large it is rarely observed. #### File Manager : ![Une image contenant texte, capture d’écran, Police, nombre Description générée automatiquement](https://blog.pradeo.com/hs-fs/hubfs/undefined-Jul-06-2023-07-08-47-3490-AM.png?width=512&height=131&name=undefined-Jul-06-2023-07-08-47-3490-AM.png) #### File Recovery and Data Recovery : ![Une image contenant texte, capture d’écran, nombre, Police Description générée automatiquement](https://blog.pradeo.com/hs-fs/hubfs/undefined-Jul-06-2023-07-09-20-4142-AM.png?width=517&height=130&name=undefined-Jul-06-2023-07-09-20-4142-AM.png) ## Sneaky behaviors used by the hacker to increase its success 1. **Looking legitimate:** When navigating on application stores, we tend to think that applications that have been largely installed are trustworthy and performant. In this case, both spyware show a big user population, yet have no reviews. We believe the hacker used an install farm or mobile device emulators to fake those numbers, hence making its applications better ranked in stores’ category lists and increase their apparent legitimacy. 2. **Requiring less user interaction:** Often, users install applications they end up not even using. For most malware, that means the attack is unsuccessful. To overcome that obstacle, File Manager and File Recovery & Data Recovery can, through the advanced permissions they use, induce the restart of the device. This then permits the apps to launch and execute themselves automatically at restart. 3. **Preventing uninstallation:** It is common to believe that on a mobile device, all applications are visible on the home screen. Although, that’s not the case and an application can simply hide its icon from the general view. Both of these malware use this technique to make their uninstallation harder. To delete them, users require going to the application list in the settings.   ## Our security recommendations First, we advise anyone using these applications to delete them. As an individual - Do not download applications that do not have any reviews while thousands of users. - Read reviews when there are any, they usually reflect the applications true nature. - Always carefully read permissions before accepting them. As an organization - Sensibilize collaborators on mobile threats. - Automate mobile detection and response to offer a secure flexibility to users, by vetting applications and preventing their launch when non-compliant with your security policy. ###### About The Author [More from this author](https://blog.pradeo.com/author/roxane-suau) ![](https://blog.pradeo.com/hs-fs/hubfs/roxane-suau.jpg?height=100&name=roxane-suau.jpg) ###### Roxane Suau #### Recommended articles [![Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/hubfs/Template%20article%20(34).png)](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) ###### [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- June 30, 2026 [![2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/hubfs/Template%20article%20(31)-1.png)](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) ###### [2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) \- June 11, 2026 [![Signal: a phishing campaign targets users' backups](https://blog.pradeo.com/hubfs/Template%20article%20(30)-1.png)](https://blog.pradeo.com/signal-a-phishing-campaign-targets-users-backups) ###### [Signal: a phishing campaign targets users' backups](https://blog.pradeo.com/signal-a-phishing-campaign-targets-users-backups) \- June 4, 2026 ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [Fence integrates Pradeo's technology to secure its clients' mobile fleets](https://blog.pradeo.com/fence-integrates-pradeos-technology-to-secure-its-clients-mobile-fleets-1) \- 6 July, 2023 [RedHook: the banking trojan that grants itself system-level access on Android](https://blog.pradeo.com/redhook-the-banking-trojan-that-grants-itself-system-level-access-on-android) \- 6 July, 2023 [What Google's latest report reveals about mobile threats](https://blog.pradeo.com/what-googles-latest-report-reveals-about-mobile-threats) \- 6 July, 2023 [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) \- 6 July, 2023 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) \- 6 July, 2023 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (28)](https://blog.pradeo.com/topic/news) - [Partners (25)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Roxane Suau" }, "dateModified" : "July 6, 2023, 12:08:21 PM", "datePublished" : "2023-07-06 12:05:38", "description" : "This week, our engine detected two spyware hiding on the Google Play Store and affecting up to 1.5 million users. ", "headline" : "Two spyware tied with China found hiding on the Google Play Store", "image" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-na1.net/hubfs/2378615/pirate-anonyme-utilise-malware-telephone-portable-pour-pirater-donnees-personnelles-argent-comptes-bancaires-concept-cybercriminalite.jpg" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```