Google has taken down a recording application called “iRecorder – Screen Recorder” from its Play Store due to its ability to steal user information.
The app initially appeared harmless until researchers discovered that the malicious functionality was introduced in version 1.3.8, released on August 24, 2022. The app, with the package name “com.tsoft.app.iscreenrecorder,” gained popularity and garnered over 50,000 installations since its release on September 19, 2021.
Lukáš Štefanko, a security researcher at ESET, expressed surprise at the developer’s approach of uploading a legitimate app and then updating it with malicious code after a significant time lapse. The added malicious code in the iRecorder app was identified as a customized version of the open-source AhMyth Android RAT (remote access trojan), which has been named AhRat.
The app’s true nature was exposed on October 28, 2022, when Kaspersky security analyst Igor Golovin flagged iRecorder as containing the AhMyth trojan. Despite this revelation, the app remained accessible throughout this period and even received a new update as recently as February 26, 2023.
The sources for this piece include an article in TheHackerNews.