A malicious Adobe Flash Player app named F11 was finally removed from Google Play, after managing to receive 100,000-500,000 downloads since last November, according to ESET. Even if it didn’t contain harmful codes, it tricked users into paying $19 for Adobe Flash Player, relying on social engineering. The free original Flash Player for Android was discontinued in 2012 due to its security flaws.
The scam’s operating mode
After you download the so-called app, it displays a tutorial, featuring instructions for getting Flash Player, and you are directed to PayPal to pay $19. ESET’s malware researcher and leader of the whole investigation, Lukáš Štefanko, says that the scam’s authors have gone quite a long way to make it appear legit. The item you end up in PayPal’s shopping basket is called Flash Player 11. The operation is not only an aggressive practice of selling users an overpriced item, but it’s also selling something without having any right to do it, as the rights are reserved only for Adobe, the maker and owner of Flash Player.
After you’ve made the payment, you get a link to a Flash Player installation tutorial and you also have to install Dolphin or Firefox browser; they support Flash Player by default, containing the Flash plugin. The operation “successfully” ends with the buyer’s ability to play Flash content on their device.
Staying safe
ESET Mobile Security detects the fake app as Android/FakeFlash.F, preventing it from installing. You’re advised to avoid all suspicious apps and you should also be aware that it’s not recommended to install Flash Player on your Android device due to security issues. But if you still want to have it installed, Adobe advises you to do so via one of the following safe means:
- By getting it from the official download center;
- By updating it via the update mechanism that comes with its genuine version;
- By installing or updating genuine versions of Adobe Flash Player that come with Google Chrome for Windows, Linux, Macintosh and Chrome OS, Microsoft Edge, Internet Explorer 11 for Windows 8.1 and 10.
Getting your money back
If you are a victim of this scam, you have 180 days at your disposal to open a dispute in PayPal’s Resolution Center. WeLiveSecurity will seek the refund and will also take legal action in order to bring the guilty parties to justice, and to put an end to this malicious scheme.
Leave a Reply