

The URLs lead to various blogs and it is likely the app is being used to increase web traffic to these sites. If none of them are present, the app will load several URLs in the background. Once network connectivity is available, the app checks if the compromised device has installed any of the malicious apps. While staying undercover, the malicious app has a background service that constantly checks the device’s network connectivity status. the malicious app forcefully redirects victims to install another app on the Play Store once it has been launched. Despite the inability to provide the functions, it claims to have. Once the Cyber Tor for Windows app is launched, it immediately calls for its icon to be removed from the home screen, while it is still active in the background. Furthermore, these malicious apps load several blog URLs in the background without the user’s knowledge. They redirect victims to install another app on the Google Play Store that displays advertisements. These malicious apps hide their existence on victim’s devices by removing their icons from the home screen.

Malicious applications, malware, or virus in the Google Play Store are all disguised as games and education apps.
