Cybersecurity firm Human has discovered and disrupted a mobile ad fraud campaign involving 89 mobile applications with a total download count of 13 million.
Dubbed Scylla, the campaign is the third adaptation of Poseidon, a fraud operation that was initially identified in 2019. Charybdis, the second iteration of the campaign, was observed in 2020.
As part of the new, still ongoing attack, Human has identified a total of 80 Android and 9 iOS applications that engaged in ad fraud through app spoofing, hidden ads, and fake clicks.
The applications contained obfuscated code similar to Charybdis and, just as that attack adaptation, targeted advertising software development kits (SDKs), Human explains.
Some of the Scylla apps contained code to pose as other, completely different applications in front of advertisers and ad tech companies. Human identified 29 Android apps pretending to be over 6,000 CTV-based applications, to bring higher advertising proceeds compared to mobile games.
Other apps contained code that informed advertisers they displayed ads to the user, although that did not happen. The code would render ads when the apps were closed, such as when the device was on the home screen, the researchers say.
Finally, some of the applications would register the information about the user’s real clicks on ads and then send it to advertisers as a fake click.
“These tactics, combined with the obfuscation techniques first observed in the Charybdis operation, demonstrate the increased sophistication of the threat actors behind Scylla,” Human notes.
The security researchers also underline the fact that Scylla is the first iteration of the campaign in which the attackers have expanded their operation to iOS.
Both Google and Apple were informed of the findings and the identified applications were removed from the Google Play Store and Apple App Store. Advertising SDK developers too were notified of the attack.
Human has published a list of Scylla applications and advises users to check that list and consider removing all applications from all devices.
Related: US Recovers $15 Million From Ad Fraud Group
Related: Ad Fraud Operation Accounted for Large Amount of Connected TV Traffic
Related: Facebook Sues Chinese Company Over Ad Fraud
More from Ionut Arghire
- Dozens of Malicious Extensions Found in Chrome Web Store
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
- Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities
- Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
Latest News
- Dozens of Malicious Extensions Found in Chrome Web Store
- What if the Current AI Hype Is a Dead End?
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
- Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities
- Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
- SBOMs – Software Supply Chain Security’s Future or Fantasy?
- Ransomware Group Used MOVEit Exploit to Steal Data From Dozens of Organizations
- Cybersecurity M&A Roundup: 36 Deals Announced in May 2023
