Android allows users to install apps that are not from the Google Play Store. Most users do not know or care but many do. Many people regularly download APK files from suspicious third-party sites. Many of these websites provide cracked APK files for paid apps. It turns out that if you download applications from such suspicious web sites, you may be worried. This is a new malware called xHelper, which is not as useful as it looks.We've all read the warnings somewhere that installing third-party applications can be a potential risk. In this case, it really is. xHelper is a creepy malware program that was discovered just in time for Halloween. In reality, the malware is not scary, but it has potential. What aggravates it is the way it stays installed on your device. Do not forget to check out our detailed discussion of malware on Android.
xHelper Android malware
The malicious program targets users in the United States, Russia and India. Jio users in India are particularly at risk. Surprisingly, researchers have spotted several examples in the code of the application that directly involve the mobile service provider.
According to security researchers Symantec, the malware has infected about 45,000 infected Android devices. Other companies, such as Norton, also agree that the number is less than 75,000. If you consider the potential goals of more than 2 billion euros, 75,000 is not huge. It's a very small percentage. xHelper is also not an Android malware that recovers your data. It just sends you boring notifications and change your browser's homepage, which is just as awkward. It can also download other malware applications.
The xHelper malware works by uncompressing a malicious charge in memory. This then connects the application to the servers and communication takes place via the SSL certificate identification. This prevents malware from being detected or intercepted. The malware is not limited to ads however. Researchers believe that application servers can provide reports, clickers, and rootkits. This will allow him to do anything that a traditional malware can do, including data collection.
To read absolutely: What is Google Play Protect and how to secure Android?
The malware does not come from any application of the Play Store. According to Malwarebytes, ""Web redirects" are the source of these infections and send users to web pages hosting Android apps. These sites explain to users how to load unofficial Android applications outside the Play Store in parallel. The code hidden in these applications downloads the xHelper Trojan."
How to get rid of xHelper?
Getting rid of this creates more problems. Unlike other malware, you can not get rid of it. This Android malware is positioned as a leading process, which means that the memory cleaner will not kill it. It does not appear in recent applications, in the application tray, and so on. You do not have to uninstall it if you find it. The application reappears itself by bypassing the uninstall process.
Even a factory reset will not help you here. It persists even through that. There is no clear thought yet on how the malware is doing this. Some suggest that the provider's code could be infected, like those of Chinese builders who do not have a large international presence. Another idea is that Chrome could be infected, which is why some users could apparently get rid of it by uninstalling Chrome.
Some researchers also believe that malware ends up in your Google backups and restores with other applications. It is also plausible, since malware can bypass security applications like Google Play Protect. Symantec indicates that the malware may be able to connect to a system application and reinstall itself.
You might want to stop installing APK files from ladle websites
At the moment, there is no cure once your device is infected. Maybe resetting your device in the factory and not restoring your data could help you. In medicine, they say that prevention is better than cure. This seems to be very true in this case, except that there does not seem to be any cure. Of course, Symantec claims that its own Symantec Endpoint Protection Mobile can mitigate xHelper malware.
Read more: Android vs. iOS users: Who are the most loyal?