Popular CamScanner PDF OCR Android App Discovered With Malware Inside

It isn't news that an Android app gets past Google's security system and stays on the Play Store to spread malware to unsuspecting users. Most of the time, however, those apps are blatant copies or ripoffs of popular apps and games. Rare but not unheard of is the case of a legit app carrying malicious code to catch users unawares. Unfortunately, that is exactly the case with the popular CamScanner app that, even more unfortunately, has been download more than 100 million times.

CamScanner is just one of many apps that offer the ability to read a paper document using an Android phone's camera and, thanks to OCR (optical character recognition), produce a PDF with text. This is pretty much one of the features of apps like Microsoft's Office Lens but CamScanner has its fair share of users as well as "copies" of the app that tries to ride on its popularity.

Unfortunately, that popularity has made it a target of malicious agents that wish to turn CamScanner into a vehicle for less innocent pieces of code. Kaspersky discovered that the app carried a Trojan Dropper that, in turn, downloads the real malware. Given limited access, these malware modules can only serve up deceptive ads but that shouldn't be reason to belittle its potential harm.

To be fair to the developers of CamScanner, they may not have been aware of the situation until the security outfit's report. App developers, most of the time, use third-party advertising tools and frameworks that, in turn, could be compromised if not malicious in themselves. Unfortunately for users, there's no foolproof way to be aware of such factors, at least not without third-party anti-malware apps and services (like Kaspersky's).

CamScanner has already been booted out of the Google Play Store but, as always, this reflects poorly on the app store's security system. It isn't the first nor will it be the last time that such an app will get past Google's automated defenses. The mobile platform maker definitely needs to step up its game in protected the more than 2 billion and growing users of the world's biggest mobile OS.