42 Adware Apps with 8 Million Downloads Traced Back to Vietnamese Student

First of all, if you have any of the below-listed apps installed on your Android device, you are advised to uninstall it immediately.

Cybersecurity researchers have identified 42 apps on the Google Play Store with a total of more than 8 million downloads, which were initially distributed as legitimate applications but later updated to maliciously display full-screen advertisements to their users.

Discovered by ESET security researcher Lukas Stefanko, these adware Android applications were developed by a Vietnamese university student, who easily got tracked likely because he never bothered to hide his identity.

The publicly available registration details of a domain associated with the adware apps helped find the identity of the rogue developer, including his real name, address, and phone number, which eventually led the researcher to his personal accounts on Facebook, GitHub, and YouTube.

“Seeing that the developer did not take any measures to protect his identity, it seems likely that his intentions weren’t dishonest at first,” Stefanko said in a blog post published today.

“At some point in his Google Play career, he apparently decided to increase his ad revenue by implementing adware functionality in his apps’ code.”

Since all 42 adware apps provide original functionalities they promised, like Radio FM, video downloader, or games, it is quite difficult for most users to spot rogue apps or find anything suspicious.

Adware Tricks for Stealth and Resilience

Dubbed “Ashas” adware family, the malicious component connects to a remote command-and-control server operated by the developer and automatically sends basic information about the Android device with one of the adware apps installed.

The app then receives configuration data from the C&C server responsible for displaying ads as per the attacker’s choice and applying a number of tricks for stealth and resilience, some of which are mentioned below.

In order to hide its malicious functionality from the Google Play security mechanism, the apps first check for the IP address of the infected device, and if it falls within the range of known IP addresses for Google servers, the app will not trigger the adware payload.

To prevent users from immediately associating the unwanted ads with his app, the developer also added functionality to set a custom delay between displaying ads and the installation of the app.

In addition, the apps also hide their icons on the Android phone’s menu and create a shortcut in an attempt to prevent uninstallation.

“If a typical user tries to get rid of the malicious app, chances are that only the shortcut ends up getting removed. The app then continues to run in the background without the user’s knowledge,” Stefanko said.

What’s interesting? If the affected user heads on the “Recent apps” button to check which app is serving ads, the adware displays Facebook or Google icon to look legitimate and avoid suspicion, tricking users into believing the ads are being displayed by a legitimate service.

Though Stefanko did not talk much about the kind of advertisements this adware serves to the infected users, adware typically bombards infected devices with advertisements, mostly leading to scam, malicious, and phishing websites.

Stefanko reported the Google security team of his findings, and the company removed the apps in question from its Play Store platform.

However, if you have downloaded any of the above-listed rogue apps on your Android device, immediately remove it by going into your device settings.

Apple iOS users are also advised to check their iPhones for these apps, as the malicious developer also has apps on Apple’s App Store. However, as for now, none of them contain any adware functionality.