Android Malware for Mobile Ad Fraud Spiked Sharply in 2019

Criminal groups are increasingly targeting users of Android mobile devices with malware for conducting ad fraud on a massive scale.

Mobile security vendor Upstream this week said that in 2019 it identified as many as 98,000 malicious Android apps and 43 million infected Android devices across the 20 countries where mobile operators currently use its technology. The numbers are up sharply from 2018 when Upstream recorded some 63,000 apps and 30 million infected devices.

A startling 32% of the top 100 most active malicious Android apps that Upstream blocked in 2019 were available for download on Google's Google Play mobile app stores. Many of them still are, according to Upstream. Another 19% of the most worst-offending malicious Android apps were also on Google Play but have been removed, the vendor noted.

More than nine out of 10 — or 1.6 billion of the 1.71 billion mobile transactions that Upstream's security platform processed last year — were blocked for being fraudulent. If those transactions had been allowed, the total cost to end users in fraudulent charges would have topped $2.1 billion, Upstream said in a report. In Egypt, 99% of the mobile transactions that Upstream's platform handled were fraudulent.

Android is the most targeted mobile OS because of how widely it is used and also because the operating system is open and therefore more vulnerable, says Dimitris Maniatis, CEO at Upstream. 

Android is a favorite playground for bad actors, especially in the case of low-end devices, he says. "Users should have a heightened awareness of any preinstalled apps that come bundled with their device and pay attention to the mobile data usage by each," Maniatis says. "Organizations should have measures in place to check the app's reviews, developer details, and list of requested permissions, making sure that they all relate to the app's stated purpose."

Upstream's analysis of 2019 data shows that the favorite apps for hiding ad-fraud malware are those that purport to improve productivity or improve device functionality. Some 23% of the malicious Android ads that Upstream encountered last year fell into this category. Other apps that attackers frequently used to hide malware included gaming apps, entertainment/lifestyle and shopping apps, communications and social apps, and music and audio and video players.

The top most downloaded malicious Android apps in 2019, according to Upstream, were Ai.type (an emoji keyboard), video downloader Snaptube, file-sharing app 4shared, video streaming and downloading app VidMate, and weather app Com.tct.weather. The top five apps alone have been downloaded some 700 million times. The top 100 malicious Android apps combined have been downloaded more than 8 billion times, Maniatis says.

In the US, the worst offenders, according to Upstream, were Free Messages, Video, Chat,Text for Messenger Plus; GPS Speedometer; QVideo, EasyScanner; and WhoUnfriendedMe.

A Stealthy Menace
In many cases, malicious apps do the function they are purportedly designed to do. For example, a weather app might forecast weather but in the background also carry out a variety of malicious activity without the user knowing a thing.

Malware for mobile ad fraud can visit websites and view and click on banner ads, make purchases, mimic a real user going through a subscription process, or deliver bogus ads to the device without the user being aware of the activity. The goal is to generate revenue for the malware author in different ways, including via payouts for fraudulent traffic and ad clicks.

Often such rogue apps can remain on a device for a long time because the malicious activity is only happening in the background. In some cases, the apps change their name after being downloaded or don't have an icon to locate them easily.

"Losses from online, mobile, and in-app advertising reached $42 billion in 2019 and are expected to reach $100 billion by 2023, according to Juniper research published last May," Maniatis says. "Considering that fraudsters operate at scale and can simultaneously target millions, tens of millions, or even hundreds of millions of devices in one hit, the means to stop them in their tracks need to likewise operate at scale."

A vast majority of the victims are users of Android phones, especially in countries including Brazil, Egypt, Indonesia, South Africa, and Ethiopia.

While detecting malicious mobile apps can be difficult, there are often some indicators — like a constantly drained battery, an overheated device, or high data charges. User ratings and reviews are also sometimes a good indicator of an apps quality, though not always.

The most downloaded malicious Android apps, for instance, all had good reviews and high rating, but only because of a carpet bombing of fake reviews, says Maniatis. "The only way to get around this currently is to scroll enough and see genuine negative reviews from real users," he says.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "7 Steps to IoT Security in 2020."