Android/Trojan.Spy.Joker

Short bio

Android/Trojan.Spy.Joker is Malwarebytes’ detection name for a family of Android apps that were found to be fleeceware.

Type and source of infection

Android/Trojan.Spy.Joker is fleeceware. Fleeceware is a type of malware for mobile devices that comes with hidden, excessive subscription fees. 

Android/Trojan.Spy.Joker was initially distributed through both Google Play store. After researchers reported the apps to Google, the malicious applications were removed from the Google Play store. However, the malicious applications might still be available on third-party app stores

Aftermath

Some users may get suspicious by an extra charge on their phone bill, it may take others months to notice. If and when they notice they need to find out how to cancel the subscription and there is no chance of getting their money back.

Protection

Malwarebytes for Android detects Android/Trojan.Spy.Joker.gfth and can remove it before it tricks users into submitting their phone number.

Remediation

These apps can be uninstalled using the mobile devices uninstall functionality, but these apps were made available under many different names. That is where Malwarebytes for Android can help you, by identifying these apps and removing them.