{"id":156418,"date":"2022-07-28T20:32:01","date_gmt":"2022-07-29T03:32:01","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=156418"},"modified":"2024-06-19T07:13:07","modified_gmt":"2024-06-19T14:13:07","slug":"new-hiddenads-malware-that-runs-automatically-and-hides-on-google-play-1m-users-affected","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-hiddenads-malware-that-runs-automatically-and-hides-on-google-play-1m-users-affected\/","title":{"rendered":"New HiddenAds malware affects 1M+ users and hides on the Google Play Store"},"content":{"rendered":"

Authored by Dexter Shin<\/p>\n

McAfee’s Mobile Research Team has identified new malware on the Google Play Store. Most of them are disguising themselves as cleaner apps that delete junk files or help optimize their batteries for device management. However, this malware hides and continuously show advertisements to victims. In addition, they run malicious services automatically upon installation without executing the app.<\/p>\n

HiddenAds functions and promotion<\/strong><\/h2>\n

They exist on Google Play even though they have malicious activities, so the victim can search for the following apps to optimize their device<\/a>.<\/p>\n

\"Figure
Figure 1. Malware on Google Play<\/figcaption><\/figure>\n

Users may generally think installing the app without executing it is safe. But you may have to change your mind because of this malware. When you install this malware on your device, it is executed without interaction and executes a malicious service.<\/p>\n

In addition, they try to hide themselves to prevent users from noticing and deleting apps. Change their icon to a Google Play icon that users are familiar with and change its name to ‘Google Play’ or ‘Setting.’<\/p>\n

\"Figure
Figure 2. The Malware hides itself by changing icons and names<\/figcaption><\/figure>\n

Automatically executed services constantly display advertisements to victims in a variety of ways.<\/p>\n

\"Figure
Figure 3. A sudden display of advertisements<\/figcaption><\/figure>\n

These services also induce users to run an app when they install, uninstall, or update apps on their devices.<\/p>\n

\"Figure<\/p>\n

\"Figure
Figure 4. A button to induce users to run app<\/figcaption><\/figure>\n

To promote these apps to new users, the malware authors created advertising pages on Facebook. Because it is the link to Google Play distributed through legitimate social media, users will download it without a doubt.<\/p>\n

\"Figure<\/p>\n

\"\"<\/p>\n

\"Figure
Figure 5. Advertising pages on Facebook<\/figcaption><\/figure>\n