Skip to main content

If You Visited This Site, You May Have Been Infected

By June 17, 2017May 24th, 2021Cybersecurity

Do you visit the GodLike Productions forum? If you’re not sure what that is, then you don’t have anything to worry about, but if you’re a member of that forum, you may have been infected by a particularly nasty malvertising app.

Check your device. If you see an app called “KS Clean” (kskas.apk), then you’re infected.

The app passes itself off as an Android App Cleaner designed to analyze apps you don’t use with frequency and delete them to save space on your device. A handy thing, but unfortunately, KS Clean doesn’t actually do that at all.

Once you install it, what it does instead is trigger the installation of an “update” which poses as a security update. Unfortunately, there’s no “cancel” or “close” button on the popup window. The only option is to click “Ok” to dismiss, which allows the installation to proceed.

Of course, the update demands admin access, and once it has that, it will relentlessly display unwanted advertising on your phone. Even worse, at this point, there’s no way to safely remove the app, save for flashing your phone and restoring it to factory defaults. Understandably, most people loathe doing this because reloading contacts and content is a painful, time consuming experience.

The rogue app was spotted by researchers from Zscaler, who report that there have been more than 300 stage one downloads and installations via the forum. The victims come primarily from France, the UK and the United States.

What’s even more troubling than the fact that this app is coming from advertising displayed on a popular forum is the fact that several users started threads complaining about the malicious app, only to see the forum administrators lock, then delete them.

In short, if you visit the GodLike Productions forum, you should check your phone to see if you’ve been infected. If so, you’re going to have to resign yourself to restoring your phone to factory settings to get away from it.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.