Camscanner, is popular app for converting photos of your documents into PDF files, was recently found to have an advertising library containing a malicious module. This app provides many feature for managing of the documents. Some of its features are free and some are paid.
CamScanner was actually a legitimate app, with no malicious intensions whatsoever, for quite some time. It used ads for monetization and even allowed in-app purchases. However, at some point, that changed, and recent versions of the app shipped with an advertising library containing a malicious module.
Specifically the Trojan Dropper module, was found malicious. It extracted and executed another malicious module from an encrypted file that was found within Camscanner’s resources.
Actually the malware was first found by Kaspersky researchers. The following is an excerpt from their blog post describing the malicious module:
“Kaspersky products detect this module as Trojan-Dropper.AndroidOS.Necro.n, which we have observed in some apps preinstalled on Chinese smartphones. As the name suggests, the module is a Trojan Dropper. That means the module extracts and runs another malicious module from an encrypted file included in the app’s resources. This “dropped” malware, in turn, is a Trojan Downloader that downloads more malicious modules depending on what its creators are up to at the moment. For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.”
Kaspersky reported the issue to Google and it was promptly taken off its Play Store. Some users of the CamScanner app had already spotted suspicious behavior and left reviews on the app’s Google Play page with warnings to avoid the app.
You can still download an app from the google or other resources. If you have previously downloaded the app, we suggest you to uninstall the app to keep your data from getting compromised and use another app which is better. For now, instead of using Camscanner we suggest to use Adobe Scan, Microsoft Office Lens or even the in-built scanning functionality of the Google Drive app for documents or PDFs.
