A friend of the site recently showed us malicious Android apps that hijack your home screen. A customer who had installed dozens of Mahjong apps on their device had their home screen replaced by a game that has since been pulled from the Google Play Store.
While it’s easy to dismiss an app taking over your home screen as a glitch, it can be quite dangerous. It might feel like your phone has a home screen virus, when really it’s an app that has set itself to replace your standard phone launcher.
Home screen permissions are an aggressive ask, and understanding why can help you avoid malware in the future.
Why your home screen is worth hijacking
Android’s home screen app is sometimes called the “launcher”. It’s the active application that you see every time you hit the home button. Many legitimate launchers aim to improve speed and responsiveness on older devices or provide custom workflows.
However, a lot of apps that replace your home screen without you asking are just ad-filled garbage for revenue. Persistent foreground access is attractive for malicious app developers looking to harvest data, and a subset of these are quite dangerous.
Launcher and firmware level access can be used and abused in several ways:
- Ad fraud. Some malware adds a clicker module in the system launcher, silently generating ad revenue in the background without you noticing.
- Overlay attacks. Launcher malware can wait for you to open a real app and draw a fake login screen on top of it, grabbing autofilled login details.
- Data theft. A recent malware campaign prompts users to set the malicious app as their default home screen, then harvested mobile numbers, one-time passcodes, and stored card details.
- Resisting removal. Some unwanted launcher apps overlay elements directly over buttons that would let you uninstall them, forcing victims to reboot into Safe Mode.
No legitimate game or utility app needs to be switched to your home screen app to function. Only custom launchers need this access.
That means that an app requesting this access itself is a reliable red flag. If you’re not actively installing a launcher app, whatever you’re installing doesn’t need home screen permissions.
How to remove malicious Android apps
Go to Settings, then Apps, then Default apps, find Home app, and select your phone’s original launcher.
Once you have your normal home screen app back, uninstall the offending app via Settings then Apps or the Play Store.
If it won’t let you uninstall normally, restart your phone into Safe Mode and remove the malicious app that way.
The steps vary, but for most devices you just hold down Power Off on the screen until the Safe Mode prompt appears.
For Samsung devices, reboot the device then hold volume down until the phone finishes booting.
Once you’re successfully in Safe Mode, it will show in the bottom left corner, or sometimes in the notification drawer. Third party apps and widgets won’t load, meaning the misbehaving app can’t block uninstallation.
Remove the offending app while in Safe Mode via Settings. To use your phone normally again, reboot once more as usual.
If you didn’t know about Safe Mode, here’s a few more hidden phone features you may not know about.
Comments