Bitdefender believes the campaign began sometime in October 2022. The threat actors used a campaign that aggressively pushes adware to android devices, and could redirect users to malware. There are 60,000 discovered unique apps carrying this adware and Bitdefender suspects there may be many more out there. 

The Romanian cybersecurity firm found the malware through an app anomaly detection technology – an industry first according to Bitdefender. Researchers believe that the malware had been thriving for an extended period of time due to the absence of behaviour-based detection capabilities on Android. 

“(The malware) most likely would have been able to stay undetected. Because of the high number of unique samples discovered, the operation is most likely fully automated,” said the researchers at Bitdefender.

The malware targeted many countries, predominantly the United States, followed by countries like South Korea, Brazil, Germany, and the United Kingdom.

The Process 

The malware was being distributed on apps not hosted on Google Play, such as games with unlocked features, free VPNs, fake videos and tutorials, Netflix, YouTube and TikTok without ads, cracked utility programs, and fake security programs.

Distribution happens when users search for these ‘modded’ apps. Websites dedicated to them will redirect them to an ad page, which would have the malware download disguised as the download portal for the modded app the user was looking for. 

From there, the installed app does not configure itself to run automatically, relying on the normal Android app installation flow. Once a user opens the app, they are faced with an error message, saying ‘the application is unavailable in your region, tap OK to uninstall’. 

Recommended

• Rural Scotland Beset by the Slowest Broadband Speeds in the UK
• Cyber Attack Targets UK HR Provider — BBC, Boots, British Airways Impacted
• UK at Risk of Losing Position as Tech Leader, Warns techUK

The app then waits two hours before registering two ‘intents’ to cause it to launch when the device is opened. 

From there, the app connects to servers which retrieve advertisement URLs, causing them to be displayed in the mobile browser. Bitdefender warns that the threat actors could easily swap the adware URLs for banking Trojans or ransomware URLs

Bitdefender warns users to only use the Google play store to download apps, not third party websites. It has also put together a video of the adware in action which can be watched here.