11 Android Apps Found Secretly Harvesting Data From Millions of Users

A mysterious company in Panama has been paying Android app developers to incorporate an SDK capable of lifting sensitive data from users’ phones, including copy-paste information.

- By Michael Kan

Security researchers have spotted 11 Android apps collecting sensitive information from user phones, including copy-and-paste data, phone numbers, and email addresses.

The findings come from security firm AppCensus: It examined a software development kit (SDK) running on the Android apps, which together were downloaded over 46 million times on the Google Play Store.

“Whenever a user copy/pastes something, it goes to a shared clipboard, which this SDK was scouring and uploading to its servers,” AppCensus said in a report in April. “What gets put there is arbitrary data, and can include passwords, for example, if a user uses a password manager.”