{"id":160794,"date":"2022-10-19T11:09:58","date_gmt":"2022-10-19T18:09:58","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=160794"},"modified":"2025-06-02T23:58:08","modified_gmt":"2025-06-03T06:58:08","slug":"new-malicious-clicker-found-in-apps-installed-by-20m-users","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/","title":{"rendered":"New Malicious Clicker found in apps installed by 20M+ users"},"content":{"rendered":"

Authored by SangRyol Ryu<\/p>\n

Cybercriminals are always after illegal advertising revenue. As we have previously reported<\/a>, we have seen many mobile malwares masquerading as a useful tool or utility, and automatically crawling ads in the background. Recently the McAfee Mobile Research Team has identified new Clicker malware that sneaked into Google Play. In total 16 applications that were previously on Google Play have been confirmed to have the malicious payload with an assumed 20 million installations.<\/p>\n

McAfee security researchers notified Google and all of the identified apps are no longer available on Google Play. Users are also protected by Google Play Protect, which blocks these apps on Android. McAfee Mobile Security products detect this threat as Android\/Clicker and protect you from malware. For more information, to get fully protected, visit McAfee Mobile Security<\/a>.<\/p>\n

How it works<\/h2>\n

The malicious code was found on useful utility applications like Flashlight (Torch), QR readers, Camara, Unit converters, and Task managers:<\/p>\n

\"\"\"\"<\/p>\n

Once the application is opened, it downloads its remote configuration by executing an HTTP request. After the configuration is downloaded, it registers the FCM (Firebase Cloud Messaging) listener to receive push messages. At first glance, it seems like well-made android software. However, it is hiding ad fraud features behind, armed with remote configuration and FCM techniques.<\/p>\n

\"\"<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Attribute name<\/td>\nKnown meaning of the value<\/td>\n<\/tr>\n
FCMDelay<\/td>\nInitial start hours after first installation<\/td>\n<\/tr>\n
adButton<\/td>\nVisivility of a button of Advertisement<\/td>\n<\/tr>\n
adMob<\/td>\nAdMob unit ID<\/td>\n<\/tr>\n
adMobBanner<\/td>\nAdMob unit ID<\/td>\n<\/tr>\n
casOn<\/td>\nWhether CAS library works or not<\/td>\n<\/tr>\n
facebookAd<\/td>\nFaceBook Ad ID<\/td>\n<\/tr>\n
fbAdRatio<\/td>\nRatio of FB AD<\/td>\n<\/tr>\n
googleAdRatio<\/td>\nRatio of AdMob<\/td>\n<\/tr>\n
is<\/td>\nDecide BootService to run or not<\/td>\n<\/tr>\n
urlOpen<\/td>\nto open popup or not when starts PowerService<\/td>\n<\/tr>\n
popUrl<\/td>\nURL for PowerService<\/td>\n<\/tr>\n
popUpDelay<\/td>\nDelay time for PowerService<\/td>\n<\/tr>\n
liveUrl<\/td>\nURL for livecheck service<\/td>\n<\/tr>\n
pbeKey<\/td>\nKey for making unique string<\/td>\n<\/tr>\n
playButtonList<\/td>\nURL for other service<\/td>\n<\/tr>\n
reviewPopupDialog<\/td>\n\u00a0‘y’ it shows review dialog<\/td>\n<\/tr>\n
tickDelay<\/td>\nDelay time for TickService<\/td>\n<\/tr>\n
tickEnable<\/td>\nValue of TickService enabled<\/td>\n<\/tr>\n
tickRandomMax<\/td>\nValue of TickService random delay<\/td>\n<\/tr>\n
tickRandomMin<\/td>\nValue of TickService random delay<\/td>\n<\/tr>\n
tickType<\/td>\nSet the type of TickService<\/td>\n<\/tr>\n
updateNotiVersion<\/td>\nValue for showing update activity<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

The FCM message has various types of information and that includes which function to call and its parameters. The picture below shows some of FCM message history:<\/p>\n

\"\"<\/p>\n

When an FCM message receives and meets some condition, the latent function starts working. Mainly, it is visiting websites which are delivered by FCM message and browsing them successively in the background while mimicking user\u2019s behavior. This may cause heavy network traffic and consume power without user awareness during the time it generates profit for the threat actor behind this malware. In the picture below there is an example of the network traffic generated to get the information required to generate fake clicks and the websites visited without user\u2019s consent or interaction:<\/p>\n

\"\"<\/p>\n

Malicious components: CAS and LivePosting<\/h2>\n

So far, we have identified two pieces of code related to this threat. One is \u201ccom.click.cas\u201d library which focuses on the automated clicking functionality while \u201ccom.liveposting\u201d library works as an agent and runs hidden adware services:<\/p>\n

\"\"<\/p>\n

Depending on the version of the applications, some have both libraries working together while other applications only have \u201ccom.liveposting\u201d library. The malware is using installation time, random delay and user presence to avoid the users from noticing these malicious acts. The malicious behavior won\u2019t start if the installation time is within an hour and during the time the user is using the device, probably to stay under the radar and avoid being detected right away:<\/p>\n

\"\"<\/p>\n

Conclusion<\/h2>\n

Clicker malware targets illicit advertising revenue and can disrupt the mobile advertising ecosystem. Malicious behavior is cleverly hidden from detection. Malicious actions such as retrieving crawl URL information via FCM messages start in the background after a certain period of time and are not visible to the user.<\/p>\n

McAfee Mobile Security detects and removes malicious applications like this one that may run in the background without user\u2019s knowledge. Also, we recommend having a security software installed and activated so you will be notified of any mobile threats present on your device in a timely manner. Once you remove this and other malicious applications, you can expect an extended battery time and you will notice reduced mobile data usage while ensuring that your sensitive and personal data is protected from this and other types of threats.<\/p>\n

IoCs (Indicators of Compromise)<\/h2>\n

liveposting[.]net<\/p>\n

sideup[.]co[.]kr<\/p>\n

msideup[.]co[.]kr<\/p>\n

post-blog[.]com<\/p>\n

pangclick[.]com<\/p>\n

modooalba[.]net<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
SHA256<\/td>\nPackage name<\/td>\nName<\/td>\nDownloaded<\/td>\n<\/tr>\n
a84d51b9d7ae675c38e260b293498db071b1dfb08400b4f65ae51bcda94b253e<\/td>\ncom.hantor.CozyCamera<\/td>\nHigh-Speed Camera<\/td>\n10,000,000+<\/td>\n<\/tr>\n
00c0164d787db2ad6ff4eeebbc0752fcd773e7bf016ea74886da3eeceaefcf76<\/td>\ncom.james.SmartTaskManager<\/td>\nSmart Task Manager<\/td>\n5,000,000+<\/td>\n<\/tr>\n
b675404c7e835febe7c6c703b238fb23d67e9bd0df1af0d6d2ff5ddf35923fb3<\/td>\nkr.caramel.flash_plus<\/td>\nFlashlight+<\/td>\n1,000,000+<\/td>\n<\/tr>\n
65794d45aa5c486029593a2d12580746582b47f0725f2f002f0f9c4fd1faf92c<\/td>\ncom.smh.memocalendar<\/td>\n\ub2ec\ub825\uba54\ubaa8\uc7a5<\/td>\n1,000,000+<\/td>\n<\/tr>\n
82723816760f762b18179f3c500c70f210bbad712b0a6dfbfba8d0d77753db8d<\/td>\ncom.joysoft.wordBook<\/td>\nK-Dictionary<\/td>\n1,000,000+<\/td>\n<\/tr>\n
b252f742b8b7ba2fa7a7aa78206271747bcf046817a553e82bd999dc580beabb<\/td>\ncom.kmshack.BusanBus<\/td>\nBusanBus<\/td>\n1,000,000+<\/td>\n<\/tr>\n
a2447364d1338b73a6272ba8028e2524a8f54897ad5495521e4fab9c0fd4df6d<\/td>\ncom.candlencom.candleprotest<\/td>\nFlashlight+<\/td>\n500,000+<\/td>\n<\/tr>\n
a3f484c7aad0c49e50f52d24d3456298e01cd51595c693e0545a7c6c42e460a6<\/td>\ncom.movinapp.quicknote<\/td>\nQuick Note<\/td>\n500,000+<\/td>\n<\/tr>\n
a8a744c6aa9443bd5e00f81a504efad3b76841bbb33c40933c2d72423d5da19c<\/td>\ncom.smartwho.SmartCurrencyConverter<\/td>\nCurrency Converter<\/td>\n500,000+<\/td>\n<\/tr>\n
809752e24aa08f74fce52368c05b082fe2198a291b4c765669b2266105a33c94<\/td>\ncom.joysoft.barcode<\/td>\nJoycode<\/td>\n100,000+<\/td>\n<\/tr>\n
262ad45c077902d603d88d3f6a44fced9905df501e529adc8f57a1358b454040<\/td>\ncom.joysoft.ezdica<\/td>\nEzDica<\/td>\n100,000+<\/td>\n<\/tr>\n
1caf0f6ca01dd36ba44c9e53879238cb46ebb525cb91f7e6c34275c4490b86d7<\/td>\ncom.schedulezero.instapp<\/td>\nInstagram Profile Downloader<\/td>\n100,000+<\/td>\n<\/tr>\n
78351c605cfd02e1e5066834755d5a57505ce69ca7d5a1995db5f7d5e47c9da1<\/td>\ncom.meek.tingboard<\/td>\nEz Notes<\/td>\n100,000+<\/td>\n<\/tr>\n
4dd39479dd98124fd126d5abac9d0a751bd942b541b4df40cb70088c3f3d49f8<\/td>\ncom.candlencom.flashlite<\/td>\n\uc190\uc804\ub4f1<\/td>\n1,000+<\/td>\n<\/tr>\n
309db11c2977988a1961f8a8dbfc892cf668d7a4c2b52d45d77862adbb1fd3eb<\/td>\ncom.doubleline.calcul<\/td>\n\uacc4\uc0b0\uae30<\/td>\n100+<\/td>\n<\/tr>\n
bf1d8ce2deda2e598ee808ded71c3b804704ab6262ab8e2f2e20e6c89c1b3143<\/td>\ncom.dev.imagevault<\/td>\nFlashlight+<\/td>\n100+<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many…<\/p>\n","protected":false},"author":695,"featured_media":160460,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4136],"class_list":["post-160794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"\nNew Malicious Clicker found in apps installed by 20M+ users | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Malicious Clicker found in apps installed by 20M+ users | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-10-19T18:09:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T06:58:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png\" \/>\n\t<meta property=\"og:image:width\" content=\"308\" \/>\n\t<meta property=\"og:image:height\" content=\"208\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"New Malicious Clicker found in apps installed by 20M+ users\",\"datePublished\":\"2022-10-19T18:09:58+00:00\",\"dateModified\":\"2025-06-03T06:58:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\"},\"wordCount\":1075,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\",\"name\":\"New Malicious Clicker found in apps installed by 20M+ users | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png\",\"datePublished\":\"2022-10-19T18:09:58+00:00\",\"dateModified\":\"2025-06-03T06:58:08+00:00\",\"description\":\"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png\",\"width\":308,\"height\":208},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"New Malicious Clicker found in apps installed by 20M+ users\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Malicious Clicker found in apps installed by 20M+ users | McAfee Blog","description":"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"New Malicious Clicker found in apps installed by 20M+ users | McAfee Blog","og_description":"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2022-10-19T18:09:58+00:00","article_modified_time":"2025-06-03T06:58:08+00:00","og_image":[{"width":308,"height":208,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"New Malicious Clicker found in apps installed by 20M+ users","datePublished":"2022-10-19T18:09:58+00:00","dateModified":"2025-06-03T06:58:08+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/"},"wordCount":1075,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/","name":"New Malicious Clicker found in apps installed by 20M+ users | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png","datePublished":"2022-10-19T18:09:58+00:00","dateModified":"2025-06-03T06:58:08+00:00","description":"Authored by SangRyol Ryu Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/10\/300x200_Guide-Protecting-Your-Digital-Identity.png","width":308,"height":208},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-malicious-clicker-found-in-apps-installed-by-20m-users\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"New Malicious Clicker found in apps installed by 20M+ users"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/160794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=160794"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/160794\/revisions"}],"predecessor-version":[{"id":215001,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/160794\/revisions\/215001"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/160460"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=160794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=160794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=160794"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=160794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}