Almost two dozen apps with more than 2 million downloads have been removed from the Google Play market after researchers found they contained a device-draining backdoor that allowed them to surreptitiously download files from an attacker-controlled server.
The 22 rogue titles included Sparkle Flashlight, a flashlight app that had been downloaded more than 1 million times since it entered Google Play sometime in 2016 or 2017, antivirus provider Sophos said in a blog post published Thursday. Beginning around March of this year, Sparkle Flashlight and two other apps were updated to add the secret downloader. The remaining 19 apps became available after June and contained the downloader from the start.
By the time Google removed the apps in late November, they were being used to click endlessly on fraudulent ads. "Andr/Clickr-ad," as Sophos has dubbed the family of apps, automatically started and ran even after a user force-closed them, functions that caused the apps to consume huge amounts of bandwidth and drain batteries. In Thursday's post, Sophos researcher Chen Yu wrote:
Andr/Clickr-ad is a well-organized, persistent malware that has the potential to cause serious harm to end users, as well as the entire Android ecosystem. These apps generate fraudulent requests that cost ad networks significant revenue as a result of the fake clicks.
From the user's perspective, these apps drain their phone's battery and may cause data overages as the apps are constantly running and communicating with servers in the background. Furthermore, the devices are fully controlled by the C2 server and can potentially install any malicious modules upon the instructions of the server.
The apps worked by reporting to an attacker-controlled domain, mobbt.com, where the infected phones would download ad-fraud modules and receive specific commands every 80 seconds. The modules caused the phones to click on huge numbers of links that hosted fraudulent apps. To prevent users from suspecting their phones were infected, the apps displayed the ads in a window that was zero pixels high and zero wide.
To give defrauded advertisers the false impression the clicks were coming from a much larger pool of authentic users, Andr/Clickr-ad manipulated user-agent strings to pose as a wide variety of apps running on a wide variety of phones, including iPhones. The following image shows a malicious app running on an Android virtual device identifying itself as running on an iPhone.
Many of the malicious Google Play apps were made by developers who had titles in the iOS App Store.