Android/Trojan.FakeFortnite

Short bio

Android/Trojan.FakeFortnite is Malwarebytes’ detection name for a clickbait trojan for the Android platform that poses as the installer for a popular game called Fortnite, that had not yet been released when the trojan was promoted in search results and on YouTube.

Symptoms

On affected systems users may see a fake loading screen and hear the Fotnite theme:

Fake loading screen

and see this icon:

fake Fortnite icon

Type and source of infection

The actual game Fortnite never was included in the installer. It just takes the user on a tour that brings in revenue for the threat-actors.

The apps are not located on the Google Play Store. Instead, people have found them by searching “How to install Fortnite on Android” or “Fortnite for Android” in Google, or stumbling across links in YouTube ads. From there, the apps can be downloaded.

Protection

Malwarebytes for Android detects the apps as Android/Trojan.FakeFortnite.

Remediation

Malwarebytes for Android can help by identifying these apps and remove.

Traces/IOCs

Package names:

com.anizz14

com.anizz14.fortnite