Virtual Event Now Live: Zero Trust Strategies Summit! - Login for Access
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Researchers Spot Aggressive Android Adware on Google Play

Highly aggressive adware has been found hidden in ten Android applications hosted on Google Play, Bitdefender reported.

Adware is highly common on both desktop PCs and smartphones. However, the threats discovered by the security firm stand out not just because they are aggressive, but also because they employ clever tricks to stay hidden on the infected device.

Highly aggressive adware has been found hidden in ten Android applications hosted on Google Play, Bitdefender reported.

Adware is highly common on both desktop PCs and smartphones. However, the threats discovered by the security firm stand out not just because they are aggressive, but also because they employ clever tricks to stay hidden on the infected device.

Once installed, the apps redirect victims to a webpage, hosted at mobilsitelerim.com/anasayfa, which serves ads designed to trick users into installing other pieces of adware disguised as system or performace updates, or get them to sign up for premium services. The displayed ads differ depending on the user’s location, Bitdefender said.

“Although they’re not malicious per se, by broadcasting sensitive user information to third parties, they resemble aggressive adware found on desktop PCs. The resulting barrage of pop-ups, redirects and ads irks users and seriously damages both the user experience and the performance of Android devices,” Bitdefender security researcher Liviu Arsene explained in a blog post.

After the adware (Android.Trojan.HiddenApp.E) is installed on the device, the redirections occur whenever the victim tries to access a website via the stock Android browser, Chrome, Firefox, and even Facebook.

“After the apps are installed, the redirects occur as soon as you open any of the mentioned browsers. Regardless of what URL you’re trying to visit, you’re redirected to ad-displaying websites. The next redirect is performed after 60 seconds have elapsed,” Arsene told SecurityWeek via email.

The applications had been uploaded to Google Play with names such as “What is my ip.” Researchers found the apps under two developer accounts, but the same individual might be behind both of them.

In order to avoid raising suspicion, the applications only require two permissions on installation (Network Communication and System Tools). While users might figure out which of the apps they installed cause the annoying redirections, removing them could prove difficult. That’s because the applications are installed with the name “System Manager,” instead of the one used to advertise them on Google Play.

Advertisement. Scroll to continue reading.

The search giant appears to have removed most of the apps from Google Play after being alerted by Bitdefender, but some of the shady programs can still be found on third-party app markets. Experts believe the adware made it past Google’s vetting process because the URL that is used to redirect users doesn’t actually serve any malicious APKs.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Threat intelligence firm Intel 471 has appointed Mark Huebeler as its COO and CFO.

Omkhar Arasaratnam, former GM at OpenSSF, is LinkedIn's first Distinguised Security Engineer

Defense contractor Nightwing has appointed Tricia Fitzmaurice as Chief Growth Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.