Hidden Devil in the Development Life Cycle: Google Play Apps Infected with Windows Executable Files
Summary: Unit 42 found 145 Google Play apps infected with malicious Microsoft Windows executable files, most released between October and November 2017 and still on the store more than half a year later; Google removed all of them after the report. The embedded PE files are inert on Android, but their presence indicates the developers were building software on compromised Windows systems, and one keylogging PE file alone infected 142 APK files.
What's compelling: The malware never had to run on a phone to do damage: a keylogger on developers' Windows machines can capture credit card numbers, Social Security numbers and passwords, and compromising developers is the same tactic behind XcodeGhost and NotPetya. Several of the infected apps had more than 1,000 installs and 4-star ratings, so the trust signal users rely on told them nothing.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026