Scammers are using Play Store apps to serve ads that nobody can escape

Most went live in September, and all share a similar code library meant to help avoid detection.

A sneaky network of more than 100 Android applications is allowing fraudsters to make money by pushing pervasive advertisements to users’ devices, according to new cybersecurity findings.

The device owners aren’t the real victims, even though they’re being exploited.  The constant stream of ads, some miniscule and others loud and inescapable, are leveraging victims’ phones as conduits for scammers to rip off companies’ marketing dollars.

More than 100 applications with some 4.6 million downloads from the Google Play Store include malicious code that enables the bogus advertising network, according to research published Thursday by the bot detection firm White Ops.

Android subscribers who downloaded these apps, some of which still existed on the Play Store at press time, believed they were installing programs that would predict their fortune, play games, take selfies or remove bugs. But the apps also abused their access to inundate the devices with advertisements that could be tracked but often couldn’t be seen.

Most of the apps first appeared in the Play Store in mid-September and, while duplicitous apps are all too common, these findings are the latest evidence ad fraud campaigners are investing in new ways to maintain access on affected devices.

“The code has aggressive persistence mechanisms,” said Inna Vasilyeva, a threat intelligence analyst at White Ops. “Once we started looking into one application, we could see that it was related to what a lot of other apps were doing.”

This malicious activity was made possible by two code libraries, which White Ops dubbed Soraka and Sogo. The apps also use AppsFlyer, a framework for mobile attribution and marketing analytics. It’s a combination that enables the apps to remove a background notification service meant to prohibit fraud activity when a phone is powered down, and schedule ads to start appearing seconds after those anti-fraud measures are disabled.

The paychecks available to ad fraud scammers are large enough to encourage the research and development of new malware and evasion techniques, which then can be repurposed to carry out more traditional forms of cybercrime. U.S. prosecutors accused one fraud ring of stealing roughly $30 million over a span of years, in part by commandeering a network of 1.7 million hacked computers.

In this case, White Ops researchers cited Best Fortune Explorer, an app still lurking on the Play Store at press time, as one of the most nefarious. The game promises to predict user’s future, such as when they will meet their true love and if they will be promoted at work. In fact, based on White Ops’ code analysis, the app sends a nonstop stream of ads that many of the thousands of negative reviewers compared to a virus.

A representative from Google’s Play Store acknowledged questions about White Ops’ findings to CyberScoop before press time.

The app, which has 170,000 downloads, was published on Sept. 9 and shares many characteristics with the larger Soraka network, White Ops determined.

Researchers from throughout the security community in recent months have tightened their focus on mobile apps that promise one thing only to do something very different. Google removed more than 100 adware-laced apps from the Play Store in response to findings from Trend Micro, while Wandera also has uncovered gaming apps capable of stealing users’ credentials.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure