{"id":4650,"date":"2026-09-29T19:40:06","date_gmt":"2026-09-29T19:40:06","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/09\/29\/dangerous-android-malware-vapor-applications-infectees-des-millions-de-dispositifs\/"},"modified":"2026-09-29T19:40:07","modified_gmt":"2026-09-29T19:40:07","slug":"dangerous-android-malware-vapor-applications-infectees-des-millions-de-dispositifs","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/fr\/2026\/09\/29\/dangerous-android-malware-vapor-applications-infectees-des-millions-de-dispositifs\/","title":{"rendered":"Dangerous Android Malware: &#8220;Vapor&#8221; applications infect\u00e9es des millions de dispositifs"},"content":{"rendered":"<div id=\"netgu-3443983587\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\">Une vaste campagne de malware connue sous le nom de &#8220;Vapor&#8221; a atteint plus de 60 millions de t\u00e9l\u00e9chargements sur Google Play. Plus de 300 applications Android malveillant servi soit comme adware ou tent\u00e9 de voler les identifiants de connexion et les informations de carte de cr\u00e9dit. Bien que Google ait depuis supprim\u00e9 toutes les applications touch\u00e9es, la menace reste, comme les attaquants ont d\u00e9j\u00e0 prouv\u00e9 qu&#8217;ils peuvent contourner les contr\u00f4les de s\u00e9curit\u00e9 de Google.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Contexte de la campagne &#8220;Vapor&#8221;<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">La campagne de malware a d&#8217;abord \u00e9t\u00e9 d\u00e9couverte par la soci\u00e9t\u00e9 de s\u00e9curit\u00e9 IAS Threat Lab, qui a identifi\u00e9 180 applications infect\u00e9es. Ces applications ont g\u00e9n\u00e9r\u00e9 environ 200 millions de demandes d&#8217;annonces frauduleuses par jour, pointant vers un vaste r\u00e9seau d&#8217;annonces frauduleuses. Un nouveau rapport de Bitdefender a port\u00e9 le nombre d&#8217;applications touch\u00e9es \u00e0 331 et a r\u00e9v\u00e9l\u00e9 que les infections \u00e9taient particuli\u00e8rement fr\u00e9quentes au Br\u00e9sil, aux \u00c9tats-Unis, au Mexique, en Turquie et en Cor\u00e9e du Sud.<\/p><div id=\"netgu-733995014\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-watchfaces-fuer-wearos-im-google-play-store-2\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844734_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U Watchfaces f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenloses-dlc-bundle-fuer-gears-of-war-e-day-liquid-death-bundle\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2844571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenloses DLC-Bundle f\u00fcr Gears of War E-Day \u2013 Liquid Death Bundle<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/kostenlose-emote-im-clash-royale-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/share-image-clashroyale-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Kostenlose Emote im Clash Royale-Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t54\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">La plupart des applications Vapor ont \u00e9t\u00e9 publi\u00e9es sur Google Play entre octobre 2024 et janvier 2025. Cependant, les t\u00e9l\u00e9chargements individuels se sont poursuivis jusqu&#8217;en mars 2025. Les applications ont \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9es via divers comptes de d\u00e9veloppeurs pour minimiser le risque d&#8217;interdiction de masse. En outre, ils ont utilis\u00e9 diff\u00e9rents SDK publicitaires pour rendre la d\u00e9tection plus difficile.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Comment le malware fonctionne et se r\u00e9pand<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les applications malveillantes se sont d\u00e9guis\u00e9es en programmes utiles tels que les trackers de fitness, les applications de prise de notes, les optimiser de batterie ou les scanners QR code. Lorsque soumis au Google Play Store, ils ne contenaient initialement aucune fonction malveillante, leur permettant de passer l&#8217;examen de s\u00e9curit\u00e9 sans probl\u00e8me. Ce n&#8217;est qu&#8217;apr\u00e8s l&#8217;installation qu&#8217;ils ont t\u00e9l\u00e9charg\u00e9 du code malveillant \u00e0 partir d&#8217;un serveur de commande et de contr\u00f4le (C2).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Parmi les applications les plus importantes, on peut citer :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AquaTracker<\/strong> \u2013 1 million de t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>ClickSave Downloader<\/strong> \u2013 1 million de t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>Scanner Hawk<\/strong> \u2013 1 million de t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>Traceur de temps d&#8217;eau<\/strong> \u2013 1 million de t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>\u00catre plus<\/strong> \u2013 1 million de t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>BeatWatch<\/strong> \u2013 500 000 t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>TraduireScan<\/strong> \u2013 100 000 t\u00e9l\u00e9chargements<\/li>\n\n\n\n<li><strong>Localisateur de mains<\/strong> \u2013 50 000 t\u00e9l\u00e9chargements<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Apr\u00e8s l&#8217;installation, les applications ont d\u00e9sactiv\u00e9 leur activit\u00e9 de lancement, les faisant dispara\u00eetre de l&#8217;aper\u00e7u de l&#8217;application. Dans certains cas, ils ont chang\u00e9 leur nom dans les param\u00e8tres et se sont pr\u00e9sent\u00e9s comme des services l\u00e9gitimes de Google tels que &#8220;Google Voice&#8221;. Ils ont utilis\u00e9 des techniques de code natif pour contourner les mesures de s\u00e9curit\u00e9 d&#8217;Android 13+ et ont dissimul\u00e9 leurs activit\u00e9s par l&#8217;utilisation de processus de fond cach\u00e9s.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>M\u00e9canismes d&#8217;impact et de fraude<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Les applications Vapor \u00e9taient principalement con\u00e7ues pour la fraude publicitaire. Ils ont forc\u00e9 l&#8217;affichage de publicit\u00e9s \u00e0 travers des superpositions d&#8217;\u00e9cran qui ne pouvaient pas \u00eatre ferm\u00e9es facilement. Dans le processus, le bouton &#8220;retour&#8221; a \u00e9t\u00e9 d\u00e9sactiv\u00e9 et les applications ont \u00e9t\u00e9 retir\u00e9es de la vue &#8220;r\u00e9centes applications&#8221;, de sorte que les utilisateurs n&#8217;ont souvent pas pu d\u00e9terminer quelle application d\u00e9clenchant les annonces.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certaines applications, cependant, sont all\u00e9es encore plus loin : elles ont affich\u00e9 de fausses pages de connexion pour Facebook et YouTube pour voler des identifiants. D&#8217;autres ont incit\u00e9 les utilisateurs \u00e0 entrer des informations de carte de cr\u00e9dit en se pr\u00e9sentant comme des processeurs de paiement de bonne r\u00e9putation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Mesures de protection et r\u00e9ponse de Google<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Apr\u00e8s la d\u00e9couverte du malware, Google a supprim\u00e9 toutes les applications identifi\u00e9es du Play Store. Un porte-parole de l&#8217;entreprise a confirm\u00e9 que les utilisateurs d&#8217;Android sont automatiquement prot\u00e9g\u00e9s par Google Play Protect. Ce m\u00e9canisme de protection est activ\u00e9 par d\u00e9faut sur tous les appareils avec les services Google Play.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Les chercheurs en s\u00e9curit\u00e9 avertissent, cependant, que des campagnes de malware similaires peuvent resurfer \u00e0 tout moment. Les utilisateurs devraient donc \u00eatre prudents et installer uniquement des applications provenant de sources dignes de confiance. Il est conseill\u00e9 d&#8217;examiner attentivement les autorisations de chaque application et de comparer r\u00e9guli\u00e8rement la liste des applications install\u00e9es avec les applications r\u00e9ellement visibles dans le tiroir de l&#8217;application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Si l&#8217;une des applications touch\u00e9es a d\u00e9j\u00e0 \u00e9t\u00e9 install\u00e9e, les utilisateurs devraient d\u00e9sinstaller imm\u00e9diatement et ex\u00e9cuter une analyse compl\u00e8te avec Google Play Protect ou un autre logiciel de s\u00e9curit\u00e9.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">La campagne Vapor montre encore une fois que m\u00eame le Google Play Store officiel n&#8217;offre aucune protection absolue contre les logiciels malveillants. Les cybercriminels utilisent de plus en plus des m\u00e9thodes sophistiqu\u00e9es pour distribuer des applications malveillantes et contourner les m\u00e9canismes de protection. Une combinaison de garanties techniques et d&#8217;un comportement prudent des utilisateurs reste le meilleur moyen de se prot\u00e9ger contre de telles menaces.<\/p>\n<div id=\"netgu-2605117160\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>La campagne &#8220;Vapor&#8221; malware a accumul\u00e9 plus de 60 millions de t\u00e9l\u00e9chargements Google Play avec 300+ applications Android malveillantes voler des donn\u00e9es et ex\u00e9cuter la fraude publicitaire.<\/p>\n","protected":false},"author":1,"featured_media":1596,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-4650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=4650"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4650\/revisions"}],"predecessor-version":[{"id":4651,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/4650\/revisions\/4651"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1596"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=4650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=4650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=4650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}