Google Disrupts 1.3 Million Device XCPE Botnet
Google takedowns XCPE botnet infecting 1.3 million Android devices and other IoT gear, developed by Videostrong for ad fraud and data theft.
Stories per day · 30 days
3 RSS
Relatedandroid4ios3midnight-mimosa3cloaking2coruna2exploit-kit2firmware2malvertising2preinstalled-malware2supply-chain2bitdefender1botnet1cryptocurrency1deepfakes1mediatek1messenger-phishing1proxyware1residential-proxy1
23 stories, newest first · one card per story
Stories tagged #ad-fraud
ADEX: 52% of 2026 ad-fraud schemes use AI as cloaking share falls
Across 1.2 million campaigns, iOS scripts and messenger phishing rose while cloaking’s share of suspensions fell to about 45%.
Coruna iOS exploit kit in malicious ads seeks crypto seed phrases
ADEX says about 50 advertiser accounts delivered version-matched chains for iOS 13.0 through 17.2.1, mainly on older devices.
2
Ad platform says malware ads fingerprint iOS before payload
ADEX linked about 50 advertiser accounts by shared cloaking behavior and says that does not mean they delivered Coruna.
1
Midnight Mimosa malware ships in Android phone firmware
A platform-signed system app installs ad-fraud plugins after briefly disabling the Play Store; proxy use was not seen.
1
Midnight Mimosa hides ad-fraud malware in cheap Android firmware
Bitdefender saw thousands of infected phones in more than 150 countries over about two years.
Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies
Preinstalled Midnight Mimosa malware on cheap Android phones enables ad fraud and residential proxies.
8
Android Firmware Malware Uses Ad Fraud and Proxy Botnets to Generate Revenue
Midnight Mimosa, preinstalled Android firmware malware, monetizes thousands of phones in 150 countries through ad fraud and proxies.
Midnight Mimosa Infects Android Phones Before Users Even Turn Them On
Midnight Mimosa ships in low-cost Android firmware, silently running ad fraud and proxy modules before first boot.
Bitdefender finds preinstalled Android malware you can’t uninstall, seen in 150 countries
Bitdefender found unremovable Midnight Mimosa malware preinstalled on cheap MediaTek Android phones in 150 countries.
Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries
Bitdefender found Midnight Mimosa firmware malware preinstalled on budget Android phones in over 150 countries.
Low-cost Android phones ship with residential proxy malware
Midnight Mimosa malware preinstalled on cheap Android phones enables ad fraud and residential proxy abuse.
5
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
Bitdefender found preinstalled Midnight Mimosa malware on low-cost Android phones, enabling fraud, proxies, and remote control.
Prostujemy: fakty o walce z oszukańczymi reklamami w Polsce
Meta disputes an Instrat foundation report on scam-ad profits in Poland and touts new AI anti-impersonation systems and advertiser verification requirements.
2
“Zero-Code Cloaking”: Attackers Weaponize Google Search and Hacked .ac.th Domain to Bypass Ad Moderation
Attackers chain Google search results, a hacked Thai .ac.th domain, and redirects to push illegal casino ads past moderation, at industrialized scale across gov/edu sites.
Hacked Thai College Website Abused to Redirect Google Searchers to Illegal Online Casino
ADEX uncovered a hacked Thai college domain serving casino pages through real Google search redirects, part of a global campaign compromising government and education sites.
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews
Bitdefender reports deceptive Google Play Early Access apps use deepfake celebrity ads and fake rewards to lure users into ad-fraud schemes.
Scareware ads keep running on Google's transparency tool, even after they're reported
NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.
Android Car Malware Spreads Through Built
Kaspersky found MoYu Group malware infecting DoFun Android car head units via firmware updaters, enabling ad fraud and proxy botnet operations.
Hackers infecting Android car systems to build proxy botnet
Kaspersky reports MoYu Group-linked malware infecting DoFun Android car head units, enrolling them in a BadBox-linked proxy botnet for ad fraud and traffic routing.
Android car head units infected with proxy botnet malware through built-in software updaters
Kaspersky found malware delivered via car head unit updaters, attributed to the MoYu Group's BADBOX operation, recruiting devices into a proxy botnet.
Malware Hijacks Android Car Head Units
Kaspersky reports first known malware infecting Android car head units via firmware updaters, repurposing vehicles as BADBOX proxy nodes for ad fraud.