Staff Reporters
Aug 8, 2023

Invisible ad fraud uncovered on Google Play apps, affects millions of Korean Android users says new cyber report

Researchers have uncovered 43 rogue apps that collectively received 2.5 million covert downloads, violating Google Play's developer standards.

Invisible ad fraud uncovered on Google Play apps, affects millions of Korean Android users says new cyber report
Cybersecurity experts McAfee's Mobile Research team has uncovered a concerning practise, whereby apps distributed through Google Play are covertly loading ads while the user’s device screen is turned off.
In an advisory released last Friday, the organisation revealed that whilst this may be a convenient way for developers to make money without subjecting consumers to invasive adverts, the action in fact, is a violation of Google Play's developer standards which specify how advertisements should be shown. 
"This affects not only the advertisers who pay for invisible ads, but also the users as it drains battery, consumes data and poses potential risks such as information leaks and disruption of user profiling caused by clicker behaviour," said McAfee.
The research uncovered 43 rogue apps that collectively received 2.5 million downloads, with the well-known TV/DMB player, music downloader, news, and calendar apps being amongst the most affected categories.
The apps in question used an advanced ad fraud library that deploys delay techniques to avoid detection and inspection. The fraudulent behaviour can also be remotely changed and pushed using the Firebase Storage or messaging services, which makes it more difficult to identify the malicious activity.
Once installed, the adware requests certain rights like "Power Saving Exclusion" and "Draw Over Other Apps," enabling covert background operations, according to McAfee. This lets in more malicious activity, such as showing phishing pages and ads without the user's knowledge.
When the device screen is off, the ad fraud starts retrieving and loading ads while the users are still unaware. In order to receive advertisement URLs from Firebase Storage, the library registers device information and requests particular domains, taxing the battery and using up mobile data.
McAfee have reported their findings to Google, resulting in a number of the apps being updated to conform with their regulations, and others deleted from the Play Store entirely.
McAfee has said it is essential for users to exercise caution and carefully evaluate the necessity of granting permissions such as the power saving exclusion before allowing them. While these might be required for certain legitimate functionalities for running in the background, it is important to consider the potential risks linked with them, such as enabling hidden behaviours or reducing the relevance of ads and contents displayed to users because of the hidden clicker behaviour.
Campaign Asia

Related Articles

Just Published

4 hours ago

TikTok reveals Symphony creative AI suite

The ByteDance-owned short-form video platform announced a host of automated creative and measurement marketing tools at its product summit on Wednesday morning.

4 hours ago

Google unleashes AI updates and adds greater ...

The technology giant has introduced new controls to its generative AI advertising tools to ensure assets remain “on brand,” as well as greater transparency in Performance Max amid advertiser pushback.

4 hours ago

Meta’s CMO on navigating cuts, competition and critics

Longtime executive Alex Schultz details the complexities of marketing a technology giant, including how to resurrect young users and reframe its platforms as a positive place for teens.

14 hours ago

Vinita Bhatia appointed editor of Campaign India

Bhatia will lead the publication's daily coverage and manage its team of journalists in the market.