Malware on My Android Phone

+1 to the answers here. Mine offers QR reading as another selectable mode, in addition to the "Still photo" and "Movie" modes. My previous phone had it integrated in the "Still photo" mode: it would simply detect and read QR codes automatically when pointing the camera towards one.

But, the phone I had before those two, had a Camera app which didn't read QR codes. So maybe it's a matter of expectations now: old Camera apps were just for Camera, while modern ones are now generally expected to be able to read QR codes? (I would, anyway)

I use the Microsoft launcher and a qr code scanner is part of it

I've switched to Android (Huawei) 2-3 years ago (after the Apple battery fiasco). I keep installed (and updated) the NoRoot Firewall app, which by default blocks all access.

I also added to my mix the Nova Launcher. It makes it easier to tap&hold an app icon, gives you a quick shortcut straight to the specific app's Settings --> Apps --> specific app's properties, in which I (usually) block access to data/wifi/roaming/background (e.g. for a QR Code reader app).

90% of my apps do not need to reach out to the interweb, and I block them both on Settings as well as Block Data/Wifi on NoRoot Firewall.

Although Huawei is beeing Huawei-ing (some sneaky apps are running).. I do like the interface into "Manually" managing backround running (battery), internet access.

What I believe the author is saying is that he received a push notification to chrome from the malicious app.

Coincidentally, I just spent my Saturday evening pouring over malicious JavaScript hosted on Cloudfront that does extensive browser fingerprinting and if a match is made to an Android device a fake Captcha pops up in Chrome which actually enables push notifications and from there a full screen pop-up appears that vibrates the devices and claims the phone is infected with (N) viruses and the “repair now” button pulls up the Play Store app to install DFNDR antivirus/cleaner.

If you look at the reviews of that app you’ll see all the angry reviews of users having their browsers hijacked.

The app itself is just an advertising server wrapped around Avast’s detection engine and is funded by the Chinese Qihoo.

It harvests users social media data and charges the users almost $10 a month after a 3 day trial period.

Novice users are unable to delete the app if “advanced protection” is enabled because it becomes a device administrator and uses deceptive language to confuse the user trying to remove the app.

If the app gets installed it will not let you clear the storage of the app from within settings even if you had never opened the app and before you agree to any terms and conditions.

The fake virus warnings that lead to DFNDR have been going on every single day since 2013.

I’m putting together a webpage that will include the JavaScript and other details as we speak.

The Google Play Store is a dumpster fire full of scam apps and Scummy developers.

My Firefox on Android has a QR code scanner, I typically use that even when I know it's not a website. When you open a new tab and select the address bar you get to see the button for the QR code scanner.