If you have this popular app installed on your mobile phone, the scam has already begun.

If you have an app iRecorder – Screen Recorder installed on your mobile phone, it is recommended delete immediatelySecurity company ESET warned last year that the popular app had used an update to infect users’ devices with a virus.

Initially an application available on Google Play from the website September 19, 2021, launched without malicious functionality and had permissions to collect microphone recordings and other files from users’ phones. So, “I could record ambient sound from the device’s microphone And upload it to the command and control (C&C) server “the attacker.”

He also had the ability to “extract from device files with extensions representing saved web pages, images, files audio, video and documents, as well as file formats used to compress multiple files.

Malicious update

However, in August 2022 update to version 1.3.8 presented malicious code. ESET has discovered that iRecorder has become A Trojan based on AhMyth, called AhRat.

“Application-specific malicious behavior includes Extract microphone recordings and steal files with specific extensionsindicating their potential involvement in the campaign espionage“, ESET said in a statement. “However, the application could not be classified into any malicious group in particular,” he adds.

When the application already had more 50,000 downloadswas removed from Google Play after ESET’s report”, and since then AhRat activity has not been detected anywhere elseSo it’s no longer possible to download it, but if you already have it installed, it’s a good idea to remove it as soon as possible.

Camilo Gutierrez AmayaThe head of ESET’s Latin American research lab was surprised by the event: “It’s rare that a developer uploads a legitimate app, waits almost a year, and then updates it with malicious code.”