Risks from Vulnerable and Malicious Android App Components

Security researchers have identified significant risks stemming from both legitimate and malicious Android applications due to insecure or outdated embedded components. One report highlights that thousands of popular Android apps, including those in travel, weather, and airline categories, still contain the deprecated libmapbox-gl.so library, which statically links to an outdated and vulnerable version of SQLite (3.24.0). This exposes users and enterprises to threats such as credential theft, data exfiltration, and denial-of-service attacks, especially in BYOD environments where employees may unknowingly install these apps on corporate devices.

Separately, advanced malicious Android apps are employing sophisticated evasion techniques to bypass antivirus detection. These apps use strong packing and obfuscation, multi-stage payload delivery, and custom package installers to avoid analysis and facilitate the installation of additional malicious components. The malicious behaviors include information theft and coin mining, with payloads often hidden in encrypted files or triggered only under specific conditions, making detection and remediation more challenging for security teams.