Beware of this fake Clubhouse app for Android with BlackRock malware

Clubhouse is one of the most popular social apps. The invite-only audio social app completed one year this week closing in on 13 million downloads. Clubhouse is currently available on iOS with an Android version in the works. A fake Clubhouse app for Android has been discovered on the Google Play Store, and it actually contains the infamous BlackRock malware.

This malicious app can get access to login credentials from more than 450 apps, and also bypass SMS-based two-factor authentication, according to a report by Irlenad-based ESET researcher Lukas Stefanko. This app looks exactly like the original Clubhouse app with the design and UI possible to fool anyone unaware. The app’s website description is the same as the iOS version with an option to “Get it on Google Play”. Once you tap on that button, the app automatically downloads on your phone. This is the biggest indicator itself as it should have actually taken you to the Google Play Store from where you would download the app.

ESET notes that there are more indicators of this being a bogus app, and these include the site using HTTP instead of HTTPS, and also the domain name ending in .mobi and not .com.

ALSO READ: BlackRock to Agent Smith, 5 Android malware you should know about

The app contains the BlackRock trojan that is infamous for stealing user credentials. Once the malware is installed on the phone, and any other susceptible app is launched it will use an overlay attack to steal the user credentials. Some of the popular apps that can be hacked include Twitter, WhatsApp, Facebook, Amazon, and Netflix.

There’s currently no Android version of the Clubhouse app. There is one in the works, and when it’s launched it will be available on the Google Play Store. Considering Clubhouse’s popularity or any new app for that matter, clone apps that can be potentially dangerous usually show up.