https://www.aftvnews.com/smarttubes-official-apk-was-compromised-with-malware-what-you-should-do-if-you-use-it/ | Skip to Main Content AFTVnews * How-To Guides + All Guides + How to Sideload Apps (e.g., Kodi) + How to enable Developer Options * Deals & Freebies * Fire TV News * Android TV News * TV App News * My Apps + Downloader App + Loader Shortcut Apps + Informer App + Bookmarker Apps * ... + About AFTVnews + Contact AFTVnews + Subscribe to Email Updates + Buyer's Guide + Recent Comments SmartTube's official APK was compromised with malware -- What you should do if you use it Posted by Elias Saba on November 29, 2025 -- 22 Comments [YouTube-Logo-2025] Earlier this week, the developer of SmartTube, the most popular alternative YouTube app for Android TV and Fire TV devices, announced that his app's digital signature had been exposed. A new version of the app using a new digital signature has since been released. While everyone is encouraged to switch to the new app, SmartTube's developer has shared more information with me about what happened that may make you want to take additional precautions if you've installed or updated the app recently. SmartTube's developer told me that the computer used to create the APKs for the project's official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware. It's unclear which version was first affected, but the compromise seems to have first occurred earlier this month. SmartTube versions 30.43 and 30.47 from APKMirror are both being flagged as infected by malware scanners. It is likely the presence of this malware that caused Google and Amazon to forcibly uninstall SmartTube on some devices, not the exposed digital signature as first suspected. SmartTube's developer says the compromised machine has been wiped and is confident that both the new SmartTube releases and the machine that created them are malware-free. All older versions of SmartTube have been removed from the project's GitHub in an abundance of caution. While there does not appear to be any evidence that the app's digital signature was actually stolen or used by malicious actors, that too has been abandoned and replaced with a new one. SmartTube version 30.56 is the first release built by the uncompromised machine and with the new digital signature. It can be installed using my Downloader app by entering code 28544 for the stable release or code 79015 for the beta release. This release does not appear on SmartTube's release list yet because it contains some known issues that the developer hopes to fix before publishing it there. It remains unknown what the malware that found its way into the official SmartTube APK files can actually do. Thankfully, SmartTube is programmed to only request minimal account permissions and does not ask for any login information directly. Even if you granted the app access to your Google Drive for backup purposes, your Google account and general Google Drive files remain out of the app's scope of permissions. Permissions regarding control of your YouTube account seem like the only thing that could have easily been exposed to the malware, as far as account access is concerned. That said, since very little is know about the malware, you should assume the worst. If you use SmartTube and are concerned about your exposure to this malware, you should factory reset any device that had the app installed, especially if you installed or updated the app in November. It would also be a good idea to audit your Google account permissions and your YouTube account activity for anything unusual. Once your devices and account are in order, if you wish to reinstall SmartTube, be sure to only install the latest version through the codes/links above. Share * Click to share on Threads (Opens in new window) Threads * Click to share on Facebook (Opens in new window) Facebook * Click to share on Reddit (Opens in new window) Reddit * Click to share on Mastodon (Opens in new window) Mastodon * Click to share on Bluesky (Opens in new window) Bluesky * Click to share on LinkedIn (Opens in new window) LinkedIn * Click to share on X (Opens in new window) X * Click to email a link to a friend (Opens in new window) Email * 22 comments 1. [18a6e57] Patrick says: November 29, 2025 at 1:32 pm Wouldn't surprise me if it wasn't the "Shai-Hulud" exploit. It got its hooks into many legit software npm packages. Reply 2. [9f5abfb] Zeric says: November 29, 2025 at 2:56 pm Deleting it and re-installing from the new uncompromised release is not a big deal, but having to go and factory reset all one's streaming devices and re-configure them from scratch is rather time consuming (I have several). In yuliskov's github announcement, he doesn't come across as this being particularly urgent, and is NOT making statements like "reset all your devices, change all your streaming account passwords". He just said going forward there won't be updates and it will have to be re-installed from the new tree. It seems at this point for most people, if google and amazon haven't uninstalled it and you are not running 30.43 or 30.47, then keep using it, and when the new version is released, remove the old one and install the new one. Reply + [17984a5] Elias Saba (AFTVnews) says: November 30, 2025 at 8:25 am Factory resetting is likely overkill. Android apps are, theoretically, sandboxed, so they shouldn't be able to affect the system or other apps. Uninstalling the infected app should be enough to clean up, but a factory reset is a guaranteed way, which is why I mention it. Reply + [8a4f4cb] Scott says: November 30, 2025 at 3:03 pm If the app was updated to v30.48, the last stable version and not updated after, would that also be a concern? Since it's not the versions spoken about, 30.43 and 30.47. This might be a stupid question. Google chromecast didn't uninstall it but gave a warning. Reply o [9b1bc19] (Original) Adam says: November 30, 2025 at 5:50 pm The "versions spoken about" preceded the v30.48 you, and I, had on out devices. So since the infection occurred at v30.43 and wasn't discovered until v30.48, whereupon the development tree was stopped, its reasonable to presume that everything compiled after 30.43 was compromised. That said, some commenters on Github said their version of 30.48 was clean. And I'm curious why Google Play Protect only detected and deleted some Smarttubes and not others. One is left to wonder if only some individual downloads were infected. A virus scanning app on my device came up clean, but who knows how definitive that is? In any event, I factory reset. Reply o [9b1bc19] (Original) Adam says: November 30, 2025 at 5:59 pm Not a stupid question, IMO, BTW. And like I said, I have no indication mine was infected, but if I got an actual warning about an app as you say you did, I would have to think that something got Google's attention, and given whats happened, it seems reasonable to presume its the aforementioned malware. Reply o [17984a5] Elias Saba (AFTVnews) says: December 1, 2025 at 9:27 am Stable v30.43 and v30.47 (and all the betas in between) are known to be bad, but may not be the only bad versions. All indications are that the dev discovered the malware and wiped his system BEFORE releasing v30.48, so it is clean. It even seems like he went back and rebuilt/ replaced v30.47 with a clean version before deciding to take it all down and change the signature, so there is actually a clean v30.47 floating around somewhere. If you only installed v30.48, or updated from a pre-November version to v30.48, then you very likely never installed any bad version and don't need to worry. But if you installed/updated to any of the November releases and then updated to v30.48, you should assume you had the malware and take precautions listed above if you want to be extra safe. Reply # [eff95a4] nh says: December 1, 2025 at 9:56 am Why does the dev's official Telegram channel, SmartTubeNewsEN, continue to offer hundreds of his SmartTube APKs for download, in the files section, including some that are known to be infected with malware? What am I missing? Reply @ [17984a5] Elias Saba (AFTVnews) says: December 1, 2025 at 11:35 am It's probably an oversight, or he hasn't gotten around to removing them. 3. [195291c] chach says: November 29, 2025 at 3:05 pm es ist wohl der HEUR:TrojanSpy/JS.Stealer.a Reply 4. [384ea10] Ghost says: November 29, 2025 at 3:50 pm If you had the malware infected version and made a SmartTube settings backup, would that be safe to restore on the new app do you think, or should you set everything up like new? Reply + [17984a5] Elias Saba (AFTVnews) says: November 30, 2025 at 8:27 am It's safe to restore from a backup created by a compromised app. The backup is just a compressed set of XML files, which are essentially just text files (non-executables), so you're safe restoring from it. Reply o [195291c] chachxx says: November 30, 2025 at 2:14 pm not all I found the Malware in the Backup Directory from the old Smarttube called NSigExtractor_29.62 , a File without ending. But i thuing delete it and the Backup is save. Reply # [78ba714] linuxct says: December 1, 2025 at 2:36 am NSigExtractor shouldn't be the malware, you will also tell its present in version 30.56. The malware should be AlphaSDK, which is what opens sockets and makes a tunnel for VPN purposes (without having done runtime analysis and only static analysis, I would say it turns your device into an exit node off of a VPN, or joins your device into a botnet) Reply 5. [73fb177] Obi Okey says: November 29, 2025 at 5:59 pm Make a smart u tube back up Reply 6. [d303486] hdmkv says: November 30, 2025 at 3:04 pm Keep getting "App not installed" on my Android TV television. Anyone else? Tried both the stable and beta versions. Reply 7. [70417fe] Tech_fan says: November 30, 2025 at 4:57 pm Wow malware? at least I use tizentube Reply + [9b1bc19] (Original) Adam says: November 30, 2025 at 5:28 pm Eh, both Tizentube and Smarttube are projects distributed on Github, no? Seems one is just as vulnerable as the other to this happening. Reply 8. [d6c026c] Brom says: November 30, 2025 at 7:46 pm This is not a big deal. You're safe as long as you downloaded the app directly from the official website. I don't understand why anyone would download it anywhere else. Reply + [9b1bc19] (Original) Adam says: November 30, 2025 at 8:54 pm I mean, the infected app not only came from the official website, it also was downloaded by others using the official Upgrade function from within the formerly clean version that was originally downloaded from the official site. So I'm sorry, what are you saying here? Reply + [17984a5] Elias Saba (AFTVnews) says: December 1, 2025 at 9:31 am This is wrong. The files on the official website are the ones that were infected with malware. Both downloading from the official website OR updating through the app itself would have resulted in installing the malware version. Reply 9. [1f7af81] Adam says: December 1, 2025 at 11:16 am typo in article, "known": > That said, since very little is know about the malware, you should assume the worst. (delete this comment) Reply Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment *[ ] Name *[ ] E-mail *[ ] Website[ ] [ ] Notify me of follow-up comments by email. [ ] Notify me of new posts by email. [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Search for:[ ][Go] TOP ANDROID TV CYBER MONDAY DEALS [B0B61V76X1]Onn HD StickList Price: [DEL:$14.88:DEL]Sale Price: $9.00 [B0D8WJYSF9]Google TV StreamerList Price: [DEL:$99.99:DEL]Sale Price: $74.99 [B07YP9FBMM]Nvidia Shield TV ProList Price: [DEL:$199.99:DEL]Sale Price: $169.99 [B07YP94PBJ]Nvidia Shield TVList Price: [DEL:$149.99:DEL]Sale Price: $124.99 [B0B75QMC7X]Onn 4K ProList Price: [DEL:$49.88:DEL]Sale Price: $44.73 TOP FIRE TV CYBER MONDAY DEALS [B0BP9SNVH9]Fire TV Stick 4K MaxList Price: [DEL:$59.99:DEL]Sale Price: $34.99 [B0F7Z4QZTT]Fire TV Stick 4K PlusList Price: [DEL:$49.99:DEL]Sale Price: $24.99 [B09BZZ3MM7]Fire TV CubeList Price: [DEL:$139.99:DEL]Sale Price: $89.99 [B0CQMRKRV5]Fire TV Stick HDList Price: [DEL:$34.99:DEL]Sale Price: $17.99 Fire TV Shortcut Apps [B096YFRKJ4]AppsPrice: FREE [B096YL279Y]Free Movies & TVPrice: FREE [B096YPQV4X]SettingsPrice: FREE [B096YJ2KVQ]Developer OptionsPrice: FREE [B096YCKH96]Bluetooth DevicesPrice: FREE Get AFTVnews articles in your inbox! Get an email anytime a new article is published. No Spam EVER and Cancel Anytime. Email Address [ ] Subscribe Get AFTVnews articles in your feed! [threads][mastodo] [Bluesky] [faceboo][Linkedi][twitter] AFTVnews Links About Contact Subscribe Threads Twitter Mastodon Facebook RSS Feed AFTVnews Apps Downloader Loader Bookmarker Informer MISC Privacy Policy DMCA Policy Disclosures Privacy Manager (c) 2025 AFTVnews |