Friday, November 1, 2024
HomeAndroid8 Popular apps With More Than 2 Billion Downloads Caught in Massive...

8 Popular apps With More Than 2 Billion Downloads Caught in Massive Ad Fraud Scheme

Published on

Malware protection

Eight apps in Google play with more than 2 billion downloads caught abusing user permissions to generate ad revenue.

Among the eight apps such as malicious apps, seven apps owned a Chinese company called company Cheetah Mobile and another app owned by Kika Tech, a Chinese based company.

According to BuzzFeed News report the ad fraud scheme tracked the user behavior in dozens of an Android app and generate a fake revenue, Google estimated the loss close to $10 million stolen from it and their ad partners by generating fake traffic.

- Advertisement - SIEM as a Service

Kochava uncovered the fraud scheme, according to their analytics report, both the Cheetah and Kika company apps tracked users when they are downloaded new apps and use their to claim the credit, this process called as click flooding and click injection.

Following are the apps involved in the ad fraud scheme

Clean Master
Security Master
CM Launcher 3D
Kika Keyboard
Battery Doctor
Cheetah Keyboard
CM Locker
CM File Manager

Credits: BuzzFeed News

Ad Fraud Scheme – Eight apps

These apps by having the permission to monitor new app install, the Cheetah apps look for new installation as soon as they detect the new downloads the Cheetah app looks for the active bounties for the downloaded app.

Credits: BuzzFeed News

Then the Cheetah apps will send fake click with relevant attribution for app installation and gain the bounty, even though the app not played any role in the installation, which is referred to as click injection.

Simmons from Kochava said the apps from Cheetah are programmed to open the newly downloaded apps without user consent, this function added to Cheetah apps in order to increase the possibility of getting credits.

The Kika Keyboard executes both the click flooding and clicks injection. It also listens for the user searches for the app in the play store when the keyboard is active.

Now the Battery Doctor and CM Locker apps are removed from the Play store.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Millions of PornHub Users Hijacked by ad Fraud Malware Infections

Cyber Criminal’s Earn $5 Million Daily By Fraudulent Video Ad “Methbot”- A Shocking Report

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...