SmartTube Infected With Malware, Developer Releases Clean Version, User Asked To Be Alert

SmartTube YouTube's popular alternative to Android TV devices (photo: x @AlternativeTo)

JAKARTA - A recent report reveals another side of the withdrawal of the popular YouTube SmartTube application for Android TV and Fire TV devices that occurred last week. Not only the issue of leaked digital signatures, SmartTube also had time to distribute a version of the application infected with malware.

According to an AFTVnews report, the developer's computer used to build SmartTube's official APK has been infiltrated by malware since early November 2024. This situation made a number of official SmartTube releases uploaded this month also carry dangerous cargo without the knowledge of the developer.

Two versions uploaded to the APKM Mirror, namely 30.43 and 30.47, have been detected as dangerous by the malware scanner. The findings are believed to be the reason Google Play Protect and Amazon suddenly deactivated SmartTube from the user's device.

SmartTube developers state that infected computers have been fully swiped. The development environment is now claimed to be clean, and the app has used a new digital signature. As a follow-up, SmartTube released version 30.56 as the first release to be built from uncompromised devices.

Users who want to install the safe version can download it via the AFTVnews Downloader application with the following two codes:

Stable: 28544

Beta: 79015

This version has not been published on GitHub because there are still some minor bugs that want to be resolved before the official release. All old versions have also been removed from GitHub as a precautionary measure.

It is not yet clear what the full capabilities of the malware are in SmartTube. Fortunately, this application does not ask for a lot of permission and does not require users to log in using Google or YouTube accounts directly. Even if the user activates backups to Google Drive, the malware is believed to not be able to access Google account data.

However, permits related to YouTube's activity control remain potentially affected. Therefore, AFTVnews recommends that every user who has installed an infected version of SmartTube for:

Do a factory reset on Android TV or Fire TV devices.

Review permission on Google accounts and YouTube activities to ensure there are no suspicious actions.

Reinstall SmartTube using version 30.56 which has been verified cleanly.

Although the current conditions are more under control, this incident serves as a reminder that the third-party application ecosystem on smart television still has risks. Especially when the distribution is not through official channels such as the Google Play Store