Cybersecurity firm Human has discovered and disrupted a mobile ad fraud campaign involving 89 mobile applications with a total download count of 13 million.
Dubbed Scylla, the campaign is the third adaptation of Poseidon, a fraud operation that was initially identified in 2019. Charybdis, the second iteration of the campaign, was observed in 2020.
As part of the new, still ongoing attack, Human has identified a total of 80 Android and 9 iOS applications that engaged in ad fraud through app spoofing, hidden ads, and fake clicks.
The applications contained obfuscated code similar to Charybdis and, just as that attack adaptation, targeted advertising software development kits (SDKs), Human explains.
Some of the Scylla apps contained code to pose as other, completely different applications in front of advertisers and ad tech companies. Human identified 29 Android apps pretending to be over 6,000 CTV-based applications, to bring higher advertising proceeds compared to mobile games.
Other apps contained code that informed advertisers they displayed ads to the user, although that did not happen. The code would render ads when the apps were closed, such as when the device was on the home screen, the researchers say.
Finally, some of the applications would register the information about the user’s real clicks on ads and then send it to advertisers as a fake click.
“These tactics, combined with the obfuscation techniques first observed in the Charybdis operation, demonstrate the increased sophistication of the threat actors behind Scylla,” Human notes.
The security researchers also underline the fact that Scylla is the first iteration of the campaign in which the attackers have expanded their operation to iOS.
Both Google and Apple were informed of the findings and the identified applications were removed from the Google Play Store and Apple App Store. Advertising SDK developers too were notified of the attack.
Human has published a list of Scylla applications and advises users to check that list and consider removing all applications from all devices.
Related: US Recovers $15 Million From Ad Fraud Group
Related: Ad Fraud Operation Accounted for Large Amount of Connected TV Traffic
Related: Facebook Sues Chinese Company Over Ad Fraud
More from Ionut Arghire
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- GitLab Security Update Patches Critical Vulnerability
- Android App With 50,000 Downloads in Google Play Turned Into Spyware via Update
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
