Analysing Third-Party App Stores for Modded APKs Through Signature Verification

CloudSEK analyzed over 50 third‑party app stores and ~990 apps, identifying 10 third‑party apps whose signatures or code differed from official APKs and which contained malicious or risky behaviors (adware, Trojans, fleeceware, and potential RATs). The report describes the APK V1 signature verification process, provides examples of affected apps and stores (e.g., PicsArt, Spotify, Gaana, Truecaller, Pinterest, Oceanofapk, Aptoide), documents malware findings such as Ewind Trojan and SandroRat, explains techniques attackers use to modify apps (debug flags, in‑app billing bypass, admin endpoint exposure, enterprise certificate abuse), and highlights user risk from installing unofficial apps.