Android is by far the most popular mobile operating system with over 2.5 billion users. That makes it a prime target for malicious third-parties that want to infect devices across the globe with malware. Most recently, the team at Barracuda Security discovered almost 200 apps that contained either
or a suspicious combination of device permissions. And now cybersecurity company White Ops has identified 116 apps – with more than 4.6 million downloads between them – it claims are performing ad fraud.
The firm said the apps are leveraging a type of code it nicknamed “Soraka” and a similar variant named “Sogo”. In a nutshell, the code allows the programmes in question to display adverts over an Android device under certain circumstances.
White Ops performed a deep dive into one of the apps in question that remains on the Google Play Store at the time of writing, Best Fortune Explorer. The app seems a tantalising premise – get a glimpse into your future – but the reality is much more frustrating.
The app was noted to leverage a framework called AppsFlyer that’s used for mobile attribution and marketing analytics. According to the security firm, if you download the app through any kind of promotion (such as on a website for example), then intrusive adverts will plague the device in question.
White Ops showed a GIF of the frustrating promotions in action. Best Fortune Explorer was exhibited to be capable of displaying full screen adverts (that last up to 20-seconds in some circumstances) over a user’s home screen.
All of the apps discovered were noted to demonstrate similar behaviours. The adware being used was noted to be capable of hiding, making it harder to detect by apps designed to root out malware like VirusTotal.
Speaking with Forbes, White Ops’ John Laycock said: “Those hiding behaviours are significant. The fraudsters are getting smarter—they know this is now an arms race, they’re trying to slow down analysis with these tactics. We’re seeing these types of behaviours more and more.”
You only need to take a read of Best Fortune Explorer’s reviews to see that something is seriously wrong with the app. Numerous comments note after installing it their phone has been burdened with annoying adverts.
One Android user said: “Totally useless. After installing, you get so many unnecessary ads. While writing this also, I got 4 ads. This is like a virus for your phone.”
Another wrote: “Don’t download it. You will just time pass. And main problem after download is you will get non-stop adds and adds. Even you cannot get to use anything. And also there is nothing like shown in adds. It is like a virus.”
At the time of writing, Best Fortune Explorer has amassed over 100,000 installs and has an average review rating of three stars.
According to Forbes, Google has been informed of the apps discovered by White Ops. However, it seems some of the 116 programmes remain on the Play Store.
White Ops urged Android fans to remove any of the apps in question if they have them installed and provided the package names for each.
They were listed as being:
• art.photo.editor.best.hot
• bedtime.reminder.lite.sleep
• com.am.i.the.best.friends.hh
• com.appodeal.test
• com.beauty.mirror.lite
• com.bedtimehelper.android
• com.bkkmaster.android
• com.calculator.game
• com.card.life
• com.cartoon.camera.pro.android
• com.code.identifier.android
• com.code.recognizer.android
• com.color.spy.game
• com.cute.kittens.puzzlegame.android
• com.cute.love.test.android
• com.daily.wonderfull.moment
• com.dailycostmaster.android
• com.dangerous.writing.note
• com.data.securite.data
• com.days.daysmatter365.android
• com.days.remind.calendar
• com.detector.noise.tool
• com.dodge.emoji.game
• com.dog.bark.picture.puzzle
• com.drink.water.remind.you
• com.ezzz.fan.sleep.noise
• com.fake.call.girlfriend.prank2019
• com.fakecaller.android
• com.fake.caller.plus
• com.false.location
• com.fancy.lovetest.android
• com.fast.code.scanner.nmd
• com.filemanagerkilopro.android
• com.filemanagerupro.android
• com.filemanageryo.android
• com.filemanageryo.android
• com.filemanagerzeropro.android
• com.find.difference.detective.little
• com.find.you.lover.test
• com.frame.easy.phone
• com.frank.video.call.lite
• com.free.code.scanner.nmd
• com.free.lucky.prediction.test
• com.funny.lie.truth.detector
• com.funny.word.game.english
• com.game.color.hunter
• com.ice.survival.berg
• com.idays.dayscounter.android
• com.important.days.matter
• com.instanomo.android
• com.isleep.cycleclock.android
• com.led.color.light.rolling
• com.lite.fake.gps.location
• com.lovetest.plus.android
com.love.yourself.women
• com.lucky.charm.text
• com.lucky.destiny.teller
• com.magnifying.glass.tool
• com.math.braingame.puzzle.riddle
• com.math.iq.puzzle.riddle.braingame
• com.math.puzzles.riddle.braingame
• com.multiple.scanner.plus.nmd
• com.my.big.days.counter
• com.my.constellation.love.work
• com.my.pocker.mobile.mirror
• com.nanny.tool.data
• com.nice.mobile.mirror.hd
• com.nomophotoeditor.android
• com.non.stop.writing
• com.phone.lite.frame
• com.phone.mirror.pro
• com.pocker.pro.mobile.mirror
• com.prank.call.fake.ring
• com.phonecallmaker.android
• com.pro.test.noise
• com.puzzle.cute.dog.android
• com.scan.code.tool
• com.simple.days.counter
• com.sleep.comfortable.sounds
• com.sleep.in.rain
• com.sleepassistantool.android
• com.sleeptimer.android
• com.smart.scanner.master.nmd
• com.test.find.your.love
com.test.fortune.tester
• com.test.lover.match
• com.tiny.scanner.tool.nmd
• com.wmmaster.android
• com.word.fun.level.english
• good.lucky.is.coming.hh
• mobi.clock.android
• my.lucky.goddness.today.test
• newest.android.fake.location.changer
• nmd.andriod.better.calculator.plus
• nmd.andriod.mobile.calculator.master
• nmd.android.best.fortune.explorer
• nmd.android.better.fortune.signs
• nmd.android.clam.white.noise
• nmd.android.fake.incoming.call
• nmd.android.good.luck.everyday
• nmd.android.location.faker.master
• nmd.android.multiple.fortune.test
• nmd.android.scanner.master.plus
• nmd.android.scanner.master.plus
• nmd.android.test.what.suitable
• photo.editor.pro.magic
• pic.art.photo.studio.picture
• relax.ezzz.sleep.cradle
• super.lucky.magican.newest
• test.you.romantic.quize
• well.sleep.guard.relax
• your.best.lucky.master.test.new
• com.ssdk.test
• bedtime.reminder.lite.sleep
• com.frank.video.call.lite.pro.prank
• com.personal.fortune.text
• com.daily.best.suit.you
• com.false.call.trick
–
express.co.uk
