Over the weekend, Iranian researcher, Nariman Gharib, reported via Twitter that he had identified a coronavirus app collecting sensitive information from users, including their real-time geo-location details, beyond what the app required to function. He used apklab.io, our mobile threat intelligence platform, to identify the origins of the app, as well as analyze the information the app was collecting and sending back to the developer’s servers. According to Gharib, the app was released by the Iranian Ministry of Health via SMS to Iranian users, and encouraged users to install the app, and do a test in order to determine if they had symptoms of coronavirus. Google has already taken action and removed the app from its Play Store, because it violates their terms and conditions.
