Jup. It just says that "the malware was disguised as PDF and QR code readers".

Not helpful, Mashable. Not helpful at all.

Right

It is about halfway down the article, but you have to dodge a few adds to get to that part.

"The two apps mentioned in the report were called "PDF Reader and File Manager" by Tsarka Watchfaces and "QR Reader and File Manager" by risovanul."

Agreed. If this article didn’t contain a way to check the apps, that would be irritating

Since the other reply was unhelpful: apps are supposed to have limited privileges and isolation from each other, yes... But the whole point of malware like this is that they figure out ways to break those restrictions and get escalated privileged.

You can get more technical detail from reading the report, in this case it looks like the app does not contain malware, but instead requests an update after install that contains the bad code and then breaks the app limitations and scans for the target banking applications and copies the security certificates.

Yes, the app doesn't steal any information from other apps. The report says the malware just displays a fake bank login page, in the hope the user gives it their details willingly.

This only would work if you check every line of source code, even the dependencies and build chain, and then build it yourself. See xz utils backdoor or heartbleed, etc.

If you read the original report, it says that it basically just displays a fake banking login page. It also says that it requested accessibility service permissions, which makes me think maybe it brought up the fake login pages "in the right moment" (as in as users opened their banking apps) to make it more convincing, even though the article doesn't specify that.

Either way, IMO the problem here is clearly with the Play Store allowing this app in, and not with Android's security itself. These apps are misusing the accessibility service system, which is obviously necessary for a ton of important use cases (and of course also requires the user to grant very explicit permission). The fact that the accessibility services are a thing doesn't delegitimize Android's security improvements over the years.

The app doesn't contain malware when it's uploaded to the play store. It forced an update after it's installed that contains the malware.

Go to Settings and search for Google Play Protect. Tap Scan, and if it results in No harmful apps found, you're safe.

How though. Over here cash isn't accepted anymore at most places. I only use cash for buying drugs. Most stores and groceries only accept card. Same with bars and clubs. I honestly have no idea besides drugs what to use cash for.