SINGAPORE — Among the recent spate of online scams involving huge losses, many seem to stem from the installation of malware through third-party applications meant for Android mobile devices.

In a media release issued over the weekend, the police said that they have received an increasing number of reports since January this year of “malware being used to compromise Android mobile devices”.

The recent types of such scams include:

The purported sale of mooncakes through social media platforms in August, where users were led to malicious links when making payment for their “purchases”Messages from purported female subjects on TikTok and dating apps, requesting that users click on a malicious link to continue the engagementThe circulation of a fake GST Voucher app, asking users to integrate the app with their bank accounts

In these scams, victims were often led to click on malicious online links.

Scammers may present such links to users through false advertisements on social media platforms, payment processes for online purchases, or in phone text messages, for example.

Through the links, victims are led either to phishing sites to give away personal data or to download harmful Android Package Kit (APK) files, used to distribute and install apps on Android mobile phones.

After downloading and installing the APK file, which includes granting accessibility and permissions to the third-party app, scammers would be able to access the victim’s device remotely.

This could allow them to steal victims’ passwords, while malware with keylogging capabilities means that scammers could retrieve the victims’ banking credentials.

Responding to TODAY’s query, the Cyber Security Agency of Singapore said that it was aware of an “uptick of online scams targeting Android users”.

“Android’s open nature allows for greater flexibility and customisation for developers and users, and they are the top mobile operating system globally, taking up about 70 per cent of the market share.

“With more users, the probability that Android phones will be targeted will be higher.” 

That said, the agency added that cyber criminals are “opportunistic and will spread their net wide”. It said that it had also seen Apple’s iOS devices being targeted, with “two recent zero-day vulnerabilities, which were used to install spyware on a range of Apple products such as Macs, iPhones and iPads”.

TODAY spoke with Google and cybersecurity experts to understand why Android devices might be more susceptible to such scams, and what can be done to better protect Android users.

WHAT ARE ANDROID PACKAGE KITS?

An APK file is an application created for Android’s operating system. It is a file format used to distribute and install apps on Android mobile phones.

Using an APK file to download a third-party app to an Android device is commonly known as “sideloading”.

In April this year, the police and CSA issued a joint advisory against downloading apps from third-party or dubious sites.

Doing so may lead to the installation of malware in the device, which in turn may result in confidential and sensitive data such as banking credentials being stolen.

WHY ARE ANDROID DEVICES MORE OPEN TO SCAMS?

Mr Aman Dayal, head of regional trust and safety operations for Google Play Asia Pacific, said that Android was built as an “open-source mobile operating system”.

An open-source software refers to software with a source code that anyone can publicly access, inspect, modify and enhance.

“For closed platforms, ‘security’ sometimes means taking choices away from users and restricting what they can do with their devices.

“Our approach is different. We have developed layers of security to help protect users from potentially harmful apps, plus other risks like network exploitation and phishing, while also allowing users to take advantage of the benefits of openness,” he added.