Take, for example, the seemingly straightforward app Brightest Flashlight, which shared users’ location and device IDs with advertisers and other third parties. On Friday, antivirus software company Avast announced it has detected another bad app(le): Cámara Visión Nocturna, a night-vision video recording app that has been signing users up for a paid messaging service without their consent.





The firm noticed that Cámara Visión Nocturna was asking for permissions unusual for a camera app, including those to read, write, and receive text messages as well as one labeled “GET_ACCOUNTS.”

Doing a bit more digging, Avast learned the app was parsing phone numbers from messaging apps, such as WhatsApp or ChatOn, sending them to a server and registering them for a paid messaging service. “Through WhatsApp, the app has access to the rest of the person’s phone so basically when it gets access there, it has access to the user‘s messages directly. It would be really easy to misuse the user’s friends’ details in the future,” chief technical officer Ondřej Vlček told Fast Company.

Those signed up for the service were billed €2 ($2.80) automatically. For some users, the charges continued racking up until the total reached €36 ($50) each month. “The following month the same process starts again and the user can be charged the same amount again,” Vlček said.