Thousands of Android Adware Apps Hide in Fake Cracked Packages
A large-scale adware campaign targeting Android devices has been discovered, involving thousands of apps disguised as cracked or modded versions of popular applications. The campaign, ongoing since October 2022, aims to generate revenue by bombarding users with unwanted ads. However, the threat actors behind it have the capability to switch tactics and distribute other types of malware such as banking Trojans or ransomware to steal sensitive information.
According to a technical report from cybersecurity company Bitdefender, approximately 60,000 unique apps carrying the adware have been identified. The majority of detections have been found in countries including the United States, South Korea, Brazil, Germany, the United Kingdom, France, Kazakhstan, Romania, and Italy.
Distribution and Spoofed Apps
Notably, none of these malicious apps are distributed through the official Google Play Store. Instead, users searching for popular apps like Netflix, PDF viewers, security software, or cracked versions of YouTube on search engines are redirected to ad pages hosting the malware.
Once installed, these apps take measures to avoid detection, as they have no visible icons or names. Furthermore, when users launch the app for the first time, they are shown a message claiming that the app is unavailable in their region and prompting them to uninstall it, while the malicious activity remains active in the background.
Mode of Operation of the Fake Apps
One notable aspect of this campaign is the adware's modus operandi. Initially, the adware remains dormant for a few days and then activates when the victim unlocks their phone, displaying full-screen ads using Android WebView.
In a separate discovery, cybersecurity firm CloudSEK found the rogue SpinOK SDK, previously disclosed by Doctor Web, embedded in 193 apps on the Google Play Store, with a total of 30 million downloads. This module presents itself as a way to engage users with mini-games and tasks to win rewards but actually contains malicious functions to steal files and manipulate clipboard contents.
Additionally, the SonicWall Capture Labs Threat research team uncovered another strain of Android malware that masquerades as legitimate apps and exploits the operating system's accessibility services to collect a wide range of information from compromised devices. This type of attack can lead to various fraudulent activities, including financial fraud and identity theft.
