Wednesday, April 23, 2025
HomeMalwareHackers Earning Money from Invisible Ads using Android Trojan that Downloads 6.5...

Hackers Earning Money from Invisible Ads using Android Trojan that Downloads 6.5 Million Times via Google Play

Published on

SIEM as a Service

Follow Us on Google News

A powerful Android Trojan distributed through Google Play store apps that posed as Fashion and game apps to generate a huge revenue using malicious invisible ads.

This Trojan distributed under several Google Play store apps which have been downloaded more than 6,500,000 times in total.

Trojan detected as Android.RemoteCode.152.origin by Russian security firm Dr.web and it mainly distributed via Game based Android apps.

- Advertisement - Google News

Malware developer embedded their malicious software module within the application that was distributed via Google Play store.

Once the Malicious apps installed into the victim’s device, silent downloading and launching of the auxiliary plug-ins designed for downloading advertising web pages and clicking on banners located on the.

How Do Hackers Earn Money using Android Trojan

Once the In-built  Trojan application(Android.RemoteCode.152.origin) successfully launched into victims Android device, it keeps starts itself every time users reboot the device.

After the successful launch, Malicious module downloads another Trojan module from the command & control servers that managed by the attackers and launch the downloaded Trojan module.

Built-in Trojan Shows Picture in Android Mobile to Monetise

Later it downloads another module which is modified version of the advertising development SDK based on MobFox SDK advertising platform which is designed for monetizing applications.

Trojan itself perform the configuration set and it silently creates various advertisements and banners, and then clicks on them, earning money for criminals.

Also it Trojan connect the dedicated mobile marketing network AppLovin which is used to generate additional income by downloading the advertisements.

Following Program was detected as Malicious apps from Google Play Store.

  • Beauty Salon – Dress Up Game, version 5.0.8;
  • Fashion Story – Dress Up Game, version 5.0.0;
  • Princess Salon – Dress Up Sophie, version 5.0.1;
  • Horror game – Scary movie quest, version 1.9;
  • Escape from the terrible dead, version 1.9.15;
  • Home Rat simulator, version 2.0.5;
  • Street Fashion Girls – Dress Up Game, version 6.07;
  • Unicorn Coloring Book, version 134.
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Exploit Cloudflare Tunnel Infrastructure to Deploy Multiple Remote Access Trojans

The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network...

Threat Actors Leverage npm and PyPI with Impersonated Dev Tools for Credential Theft

The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted...

Hackers Exploit Legitimate Microsoft Utility to Deliver Malicious DLL Payload

Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into...

Cybercriminals Exploit Network Edge Devices to Infiltrate SMBs

Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Latest Lumma InfoStealer Variant Found Using Code Flow Obfuscation

Researchers have uncovered a sophisticated new variant of the notorious Lumma InfoStealer malware, employing...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

Hackers Claim to Sell ‘Baldwin Killer’ Malware That Evades AV and EDR

A notorious threat actor has allegedly begun selling “Baldwin Killer,” a sophisticated malware toolkit...