Google Play apps with >20M downloads depleted batteries and network bandwidth

“Mainly, it is visiting websites which are delivered by FCM message and browsing them successively in the background while mimicking user’s behavior,” McAfee’s SangRyol Ryu wrote. “This may cause heavy network traffic and consume power without user awareness during the time it generates profit for the threat actor behind this malware.”

The post included the following screenshot illustrating a small sampling of the additional network demands a device made when performing the fraud.

All of the malicious apps came with a code library named com.liveposting, which acts as an agent and runs hidden adware services. Other apps also came with an additional library called com.click.cas, which focused on the automated clicking functionality. To conceal the fraudulent behavior, the apps waited about an hour after installation before running the libraries.

Ad fraud works through affiliate programs, which allow a third party to receive a cut of the ad revenue in return for providing links that lead end users to ads. Rather than genuinely bringing real users to the site, the fraudsters simulate the referral using bots or other automated methods to mimic real user engagement.

The apps detected by McAfee include:

In a statement, a Google spokesperson noted that all apps reported by McAfee had been removed. The representative went on to say: “Users are also protected by Google Play Protect, which blocks these apps on Android devices.” The spokesperson didn’t answer a follow-up question asking how the apps racked up 20 million installations if they’re blocked.