Categories: AdwareAndroid

Stealthy Android Malware Disguised as an Adblocker and Run in Background By Requesting Fake VPN Connection

Researchers observed a stealthy Android malware poses as ad blocker serves full-screen ads while opening the browsers, in the notification section and home widgets.

The malicious app(Ads Blocker V3.9) infection is on the rise, Malwarebytes researchers able to obtain 1,800 samples through their Mobile Intelligence System which shows the infection rate is high.

Good news is the app not distributed from Google play, still, the source of infection is unknown and it targets mainly the users in the united states and also in European countries such as France and Germany.

Trouble Starts Right After Installation

After the installation straightaway, the app asks to Allow display over other app rights form the users, once it granted then it shows a fake popup asking for the Connection request.

For an adblocker app, why it requires to connect with a VPN service? yes, it is a fake popup to make the malware run the malware all the time in the background.

Next, it asks to add a home screen widget, once added it hides and the widget is nowhere found. Nathan Collier who analyzed the malware managed to find the widget on a new home screen page.

To make it legit it also includes some jargon codes, once the app installed no icons will be created and it is hard to find. The only clue is the blank white notification and the small key icon status bar.

“If you try to find Ad Blocker on the App info page on your mobile device to remove manually, it once again hides with a blank white box. Also if you click on the blank screen it may lead to uninstall other malware, reads Malwarebytes report.”

Ads Everywhere

It shows ads in all possible places of devices, starting from the basic full-page ad, ads in notifications, ads in the default browser and with the home screen.

Researchers believe that Ads Blocker V3.9 is more stealthy than xHelper and is capable of reaching the same rate of infection.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

View Comments

  • I recently encountered this after clicking on an ad by mistake (fake popup masked as a download link). When I ran it and saw that it masked itself as adblocker and asked for overlay permissions and VPN connection I immediately canceled. However I shortly after got an on screen popup even though I did not give it any authorization(!!). I scanned using Malware bytes and the built in McAfee scanner but nothing turned up. I did see however that both scanners scanned an "empty" icon app without detecting any problems. I then rebooted my Samsung S10 in safe mode and in the apps I found the 6MB empty icon app listed which I terminated and uninstalled. Apparently everything is back to normal after exiting safe mode.

Recent Posts

Cisco Nexus Vulnerability Allows Attackers to Inject Malicious Commands

Cisco Systems has issued a critical security advisory for a newly disclosed command injection vulnerability…

1 hour ago

New Wi-Fi Jamming Attack Can Disable Specific Devices

A newly discovered Wi-Fi jamming technique enables attackers to selectively disconnect individual devices from networks…

1 hour ago

GitLab Vulnerabilities Allow Attackers to Bypass Security and Run Arbitrary Scripts

GitLab has urgently released security updates to address multiple high-severity vulnerabilities in its platform that…

3 hours ago

LibreOffice Flaws Allow Attackers to Run Malicious Files on Windows

A high-severity security vulnerability (CVE-2025-0514) in LibreOffice, the widely used open-source office suite, has been…

4 hours ago

Cisco Nexus Switch Vulnerability Allows Attackers to Cause DoS

Cisco Systems has disclosed a high-severity vulnerability (CVE-2025-20111) in its Nexus 3000 and 9000 Series…

4 hours ago

Silver Fox APT Hackers Target Healthcare Services to Steal Sensitive Data

A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver Fox,…

13 hours ago