Android adware apps in Google Play downloaded over 20 million occasions

Security researchers at McAfee have found a set of 16 malicious clicker apps that managed to sneak into Google Play, the official app retailer for Android.

Clicker apps are a particular class of adware that masses adverts in invisible frames or within the background and clicks them to generate income for his or her operators.

The impact on the gadget could also be a drop in efficiency, overheating, elevated battery utilization, and inflated cell information expenses.

All 16 apps have been faraway from Google Play after McAfee reported them. However, they nonetheless amassed an set up rely of 20 million.

The nastiest of the bunch is DxClean, which was put in 5 million occasions earlier than it being eliminated. It had a comparatively constructive total person score of 4.1 out of 5 stars.

DxClean posed as a system cleaner and optimizer, promising to detect causes of system slowdowns and cease commercial annoyances whereas performing the precise reverse actions within the background.

Clicker app features

After launch, the apps obtain their configuration from a distant location by way of an HTTP request and register an FCM (Firebase Cloud Messaging) listener to obtain push messages.

These messages include directions for the clickers, akin to which features to name and what parameters to make use of.

“When an FCM message receives and meets some condition, the latent function starts working,” McAfee explains within the report.

“Mainly, it is visiting websites which are delivered by FCM message and browsing them successively in the background while mimicking user’s behavior,” the researchers add.

The auto-clicking perform is dealt with by the ‘click.cas’ element, whereas the agent managing the hidden adware providers is ‘com.liveposting’.

McAfee analysts say that the liveposting SDK can function by itself, too, probably to create solely advert impressions, however latest variations of the apps characteristic each libraries.

The sufferer by no means interacts with the opened web sites and is unlikely to appreciate the underground processes that generate revenue for the distant operators.

To keep beneath the person’s radar, the malicious operation doesn’t start within the first hour after putting in the app delays its begin when the person is actively utilizing the gadget.

Some methods to find if apps of this sort are current on the gadget, customers ought to examine battery and web utilization. If the system stayed unused for a interval, there isn’t a justification for larger battery drainage and elevated cell information consumption.

For the whole record of the 16 clicker apps, try the symptoms of compromise part on the backside of McAfee’s report.