Over 150 Fake Jio Android Apps Offer Free Data but Deliver Only Ads

Symantec has uncovered 152 malicious Android apps being circulated online that claim to provide free data boosts for Jio customers. The apps masquerade as apps from Reliance Jio Infocomm Limited. Reliance Jio Infocomm Limited, also known as Jio, is the largest 4G network in India, with more than 300 million subscribers.

These 152 APKs were developed under 21 different package names, all of which claim to offer a free daily data allowance of 25 GB or 125 GB for a period of time ranging from just one day to one year. However, users who download these malicious apps will not receive any free data boosts; instead, their devices will be used to generate advertising revenue for the developers of the apps.

Jio customers with JioSecurity installed on their devices are protected from these malicious apps. JioSecurity, which is powered by Norton Mobile Security, is available to Jio customers for free from the MyJio app.

While the fake offers promised in these apps vary, the tricks they use to deceive users are quite similar.

Trick 1: The art of imitation

The icons used by the malicious apps are identical to that of the legitimate MyJio app (see Figure 1) and the names used are all variations of the legitimate app name (MyJio). These imitation tactics alone may be enough to fool many users into installing one of the fake apps. Coupled with the offer of a free data boost and it's easy to see how these fake apps could be tempting for users.

Upon launching the malware, victims are greeted with a splash screen that also resembles the original app. The user is eventually shown the malware's main screen which shares the same user interface (UI) design and structure of its legitimate counterpart (Figure 2).

Trick 2: False impression of progress

On the fake app's main screen, the user is shown a dialog box or a text field, requesting the victim's cellphone number in order to activate the free data boost offer. After entering a 10-digit cell number—regardless of the validity of the entered number—a dummy loading spinner is shown, giving the victim the impression that a request is being made to a server to check their eligibility. In fact, the malicious app's source code shows that no real connections or processing is taking place while the spinner is displayed, and a sleep timer has been added to extend the time the spinner stays onscreen (Figure 4). After some time, the user is congratulated and informed that their number is eligible to receive the offer, after they follow some more instructions to activate it.

This ploy was used consistently by the malicious apps, always making victims think they are just one step away from getting that elusive offer.

Trick 3: Spread the word

Next, victims are asked to share the app with 10 contacts via WhatsApp in order to activate the offer. Other variants of the malware ask victims to follow the developer's Instagram account or a Telegram group (which are listed in the app). There are also some versions that ask victims to share the app via SMS. Worse still, some of the apps don't even bother to ask the victim and just go ahead and send the SMS messages without the user's knowledge (Figure 6). The messages contain a link to download the malicious app and are sent to numbers in the victim's contact list.

Trick 4: Aggressive advertisements

The malicious apps' final trick is displaying advertisements. Some variants attempt to trick the user into clicking on an advertisement in order to get the offer. Other versions spawn as many as 16 processes automatically to show different web pages to the victim. A more aggressive move still involves advertisements being spawned non-stop by some versions of the apps, which effectively results in an infinite loop of web pages popping up on the device.

From January through June 2019, our telemetry shows that these fake apps were installed on more than 39,000 mobile devices, with the majority of them located in India. The total installation count of these apps, however, is likely to be much higher than 39,000 since victims are requested to share the apps with their friends and families.

Protection

Symantec and Norton products detect these apps as the following:

• Android.Fakeapp

 

Mitigation

While the lure of free data boosts can be tempting, we advise users to always validate with the official parties through proper channels.

Stay protected from mobile risks and malware by taking these precautions:

• Keep your software up to date.
• Do not download apps from unfamiliar sites.
• Only install apps from trusted sources.
• Pay close attention to the permissions requested by apps.
• Install the JioSecurity app to protect your device and data. JioSecurity is an advanced mobile security app powered by Norton Mobile Security. JioSecurity is available to Jio customers free of charge from the MyJio app or Jio.com.
• Make frequent backups of important data.

Special thanks to John Hou and Liu Zhe for their help with this research.

 

Indicators of Compromise