{"id":166994,"date":"2023-04-12T15:49:01","date_gmt":"2023-04-12T22:49:01","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=166994"},"modified":"2024-11-21T06:53:05","modified_gmt":"2024-11-21T14:53:05","slug":"goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/","title":{"rendered":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea"},"content":{"rendered":"

Authored by SangRyol Ryu<\/p>\n

McAfee<\/span>\u2019s<\/span> Mobile Research Team discovered a <\/span>software <\/span>library <\/span>we\u2019ve <\/span>named <\/span>Goldoson,<\/span> which<\/span> collects lists of applications installed, and <\/span>a history of <\/span>Wi-Fi and <\/span>Bluetoot<\/span>h<\/span> devices information<\/span>, including<\/span> nearby GPS locations.<\/span> Moreover, the library is armed with<\/span> the\u00a0functionality<\/span> to perform ad fraud by clicking advertisements in the background without the user\u2019s consent.<\/span> The research team has found more than 60 applications containing this <\/span>third-party <\/span>malicious library, with more than <\/span>100<\/span> million downloads confirmed in the <\/span>ONE store and Google Play <\/span>app download <\/span>markets<\/span> in South Korea<\/span>.<\/span> While t<\/span><\/span>he<\/span> malicious library was made by someone else, not the app developers<\/span>,<\/span> the <\/span>risk to <\/span>installers of the apps <\/span>remains.<\/span><\/span>\u00a0<\/span><\/p>\n

McAfee Mobile Security<\/span><\/span><\/a> detect<\/span>s<\/span> this threat as Android\/<\/span>Gold<\/span>o<\/span>son<\/span> and protect<\/span>s<\/span> customers <\/span>from this and many other mobile threats.<\/span> McAfee <\/span>is <\/span>a member of the <\/span><\/span>App Defense Alliance<\/span><\/span><\/a> focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem<\/span>. We<\/span> reported the discovered apps to Google, which took prompt action<\/span>. <\/span>Google has<\/span> reportedly<\/span> notified<\/span> the developers that their apps are in violation of Google Play policies and fixes are needed to <\/span>reach<\/span> compliance.<\/span> Some apps were removed from Google Play while others were updated by the official developers. <\/span>Users<\/span> are encouraged to update the <\/span>app<\/span>s<\/span> to the latest version to remove <\/span>the <\/span>identified<\/span> threat<\/span> from their devices.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/div>\n

Top 9 applications previously infected by Goldoson on Google Play<\/p>\n

How does it affect users?<\/span>\u00a0<\/span><\/h2>\n

T<\/span>he <\/span>Goldoson<\/span> library <\/span>registers the device and <\/span>gets remote configurations at the same time <\/span>the app <\/span>runs.<\/span> The library <\/span>name <\/span>and the remote server <\/span>domain <\/span>varies <\/span>with<\/span> each <\/span>application,<\/span> and it is <\/span>obfuscated<\/span>.<\/span> The name <\/span>Gold<\/span>o<\/span>son<\/span> is after the first found domain name.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"
Mutating class names<\/figcaption><\/figure>\n

Remote configuration <\/span>contains<\/span> the parameters for each <\/span>of <\/span>functionalities and <\/span>it <\/span>specifies how often <\/span>it <\/span>runs the components. Based on the parameters, t<\/span>he library periodically checks<\/span>,<\/span> pulls device <\/span>information,<\/span> and send<\/span>s<\/span> them to the <\/span>remote<\/span> server<\/span>s<\/span>.<\/span> The tags such as \u2018<\/span>ads_enable<\/span>\u2019 or \u2018<\/span>collect_enable<\/span>\u2019 <\/span>indicates<\/span> each functionality to work or not<\/span> while <\/span>other parameters define conditions and availability.<\/span><\/span>\u00a0<\/span><\/p>\n

\"A<\/p>\n

A response of remote configuration<\/p>\n

The library <\/span>includes<\/span> the <\/span>ability to load <\/span>web pages without user <\/span>awareness<\/span>.<\/span> T<\/span>he functionality <\/span>may be <\/span>abused to load ads<\/span> for <\/span>financial<\/span> profit<\/span>.<\/span> Technically<\/span>, <\/span>the library loads HTML code and injects <\/span>it in<\/span>to <\/span>a customized and <\/span>hidden <\/span>WebView<\/span> and it <\/span>produces<\/span> hidden <\/span>traffic by visiting<\/span> the <\/span>URLs<\/span> recursively<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"Pages
Pages loaded without user perception<\/figcaption><\/figure>\n

C<\/span>ollected data <\/span>is <\/span>sent out periodically<\/span> every two days but the cycle is subject to change by the remote configuration<\/span>.<\/span> The information <\/span>contains<\/span> some sensitive data including the list of installed application<\/span>s<\/span>, location history, MAC address of Bluetooth and <\/span>Wi-Fi<\/span> nearby, and more. This may <\/span>allow <\/span>individuals<\/span> to be <\/span>identified<\/span> when the data<\/span> is<\/span> combined.<\/span> The following tables <\/span>show<\/span> t<\/span>he data<\/span> observed<\/span> on our test device<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"Collected
Collected Data sent out in JSON format<\/figcaption><\/figure>\n

Google Play considers the list of installed <\/span>apps to be\u202f<\/span><\/span>personal and sensitive user data<\/span><\/span><\/a> and require<\/span>s<\/span> a special permission declaration to get it. <\/span>U<\/span>sers with Android<\/span> 11 and <\/span>above are more protected against apps <\/span>attempting<\/span> to gather all installed apps. However, even with the recent version of Androi<\/span>d, we found that around 10% of the apps with <\/span>Goldoson<\/span> have the permission \u201cQUERY_ALL_PACKAGES\u201d<\/span> that allows them to <\/span>access<\/span> app<\/span> information<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

Likewise, <\/span>with <\/span>Android 6.0 or higher, <\/span>users <\/span>may<\/span> be asked for<\/span> permission<\/span>s<\/span> such as <\/span>Location,<\/span> Storage,<\/span> or Camera<\/span> at runtime.<\/span> If <\/span>user<\/span> allows the location permission, the app can access not only GPS data but also Wi-Fi and Bluetooth device information nearby. Based on <\/span>BSSID (<\/span>Basic Service Set Identifier) and RSSI (Received Signal Strength Indicator),<\/span> the application can <\/span>determine<\/span> the location <\/span>of the device <\/span>more accurately <\/span>than GPS<\/span>, <\/span>especially<\/span> indoors<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

<\/div>\n

A demo of runtime permission request<\/p>\n

Where do the apps come from?<\/h2>\n

The infected applications come from various <\/span>Android <\/span>application stores. More than <\/strong><\/span>100<\/span><\/strong> million downloads<\/strong> have been tracked through Google Play.<\/span> After that, <\/span>ONE<\/span> store<\/span>, Korea\u2019s leading app store,<\/span> follows with <\/span>about <\/span>8<\/span> million<\/span> installation<\/span>s<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

Conclusion<\/h2>\n

As<\/span> applications <\/span>continue to scale in <\/span>size<\/span> and leverage additional <\/span>external libraries<\/span>, it is important <\/span>to <\/span>understand <\/span>the<\/span>ir<\/span> behavior<\/span>.<\/span> App developers should be upfront about <\/span>librar<\/span>ies <\/span>used and take <\/span>precautions<\/span> to protect <\/span>users’ information<\/span>. <\/span>McAfee Mobile Security products <\/span>can also help <\/span>detect threat<\/span>s <\/span>and protect you from not only <\/span>malware but<\/span> also unwanted programs. For more information, visit our <\/span><\/span>McAfee Mobile Security<\/span><\/span><\/a>.<\/span><\/span>\u00a0<\/span><\/p>\n

Identified Apps and Goldoson Domains<\/h2>\n

Domains<\/h3>\n
    \n
  • bhuroid.com<\/li>\n
  • enestcon.com<\/li>\n
  • htyyed.com<\/li>\n
  • discess.net<\/li>\n
  • gadlito.com<\/li>\n
  • gerfane.com<\/li>\n
  • visceun.com<\/li>\n
  • onanico.net<\/li>\n
  • methinno.net<\/li>\n
  • goldoson.net<\/li>\n
  • dalefs.com<\/li>\n
  • openwor.com<\/li>\n
  • thervide.net<\/li>\n
  • soildonutkiel.com<\/li>\n
  • treffaas.com<\/li>\n
  • sorrowdeepkold.com<\/li>\n
  • hjorsjopa.com<\/li>\n
  • dggerys.com<\/li>\n
  • ridinra.com<\/li>\n
  • necktro.com<\/li>\n
  • fuerob.com<\/li>\n
  • phyerh.net<\/li>\n
  • ojiskorp.net<\/li>\n
  • rouperdo.net<\/li>\n
  • tiffyre.net<\/li>\n
  • superdonaldkood.com<\/li>\n
  • soridok2kpop.com<\/li>\n<\/ul>\n

    List of Apps and Current Status<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Package Name<\/span><\/b>\u00a0<\/span><\/td>\nApplication Name<\/span><\/b>\u00a0<\/span><\/td>\nGooglePlay Downloads<\/span><\/b>\u202f<\/span><\/b>\u00a0<\/span><\/td>\nGP<\/span><\/b>
    \nStatus<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
    com.lottemembers.android<\/span>\u00a0<\/span><\/td>\nL.POINT with L.PAY<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\n\u00a0Updated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.Monthly23.SwipeBrickBreaker<\/span>\u00a0<\/span><\/td>\nSwipe Brick Breaker<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.realbyteapps.moneymanagerfree<\/span>\u00a0<\/span><\/td>\nMoney Manager Expense & Budget<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.skt.tmap.ku<\/span>\u00a0<\/span><\/td>\nTMAP – <\/span>\ub300\ub9ac<\/span>,<\/span>\uc8fc\ucc28<\/span>,<\/span>\uc804\uae30\ucc28<\/span> \ucda9\uc804<\/span>,<\/span>\ud0a5\ubcf4<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.co.lottecinema.lcm<\/span>\u00a0<\/span><\/td>\n\ub86f\ub370\uc2dc\ub124\ub9c8<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.ktmusic.geniemusic<\/span>\u00a0<\/span><\/td>\n\uc9c0\ub2c8\ubba4\uc9c1 – genie<\/span>\u00a0<\/span><\/td>\n10M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.cultureland.ver2<\/span>\u00a0<\/span><\/td>\n\uceec\uccd0\ub79c\ub4dc<\/span>[<\/span>\uceec\uccd0\uce90\uc26c<\/span>]<\/span>\u00a0<\/span><\/td>\n5M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.gretech.gomplayerko<\/span>\u00a0<\/span><\/td>\nGOM Player<\/span>\u00a0<\/span><\/td>\n5M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.megabox.mop<\/span>\u00a0<\/span><\/td>\n\uba54\uac00\ubc15\uc2a4<\/span>(Megabox)<\/span>\u00a0<\/span><\/td>\n5M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.co.psynet<\/span>\u00a0<\/span><\/td>\nLIVE Score, Real-Time Score<\/span>\u00a0<\/span><\/td>\n5M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    sixclk.newpiki<\/span>\u00a0<\/span><\/td>\nPikicast<\/span>\u00a0<\/span><\/td>\n5M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.appsnine.compass<\/span>\u00a0<\/span><\/td>\nCompass 9: Smart Compass<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.gomtv.gomaudio<\/span>\u00a0<\/span><\/td>\nGOM Audio – Music, Sync lyrics<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.gretech.gomtv<\/span>\u00a0<\/span><\/td>\n\uacf0<\/span>TV – All About Video<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.guninnuri.guninday<\/span>\u00a0<\/span><\/td>\n\uc804\uc5ed\uc77c<\/span> \uacc4\uc0b0\uae30<\/span> \ub514\ub370\uc774<\/span> \uacf0\uc2e0\ud1a1<\/span>–<\/span>\uad70\uc778<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.itemmania.imiapp<\/span> \u00a0<\/span><\/td>\n\uc544\uc774\ud15c\ub9e4\ub2c8\uc544<\/span> – <\/span>\uac8c\uc784<\/span> \uc544\uc774\ud15c<\/span> \uac70\ub798<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.lotteworld.android.lottemagicpass<\/span>\u00a0<\/span><\/td>\nLOTTE WORLD Magicpass<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.Monthly23.BounceBrickBreaker<\/span>\u00a0<\/span><\/td>\nBounce Brick Breaker<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.Monthly23.InfiniteSlice<\/span>\u00a0<\/span><\/td>\nInfinite Slice<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.pump.noraebang<\/span>\u00a0<\/span><\/td>\n\ub098\ud640\ub85c<\/span> \ub178\ub798\ubc29<\/span>–<\/span>\uc27d\uac8c<\/span> \ucc3e\uc544<\/span> \uc774\uc6a9\ud558\ub294<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.somcloud.somnote<\/span>\u00a0<\/span><\/td>\nSomNote – Beautiful note app<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.whitecrow.metroid<\/span>\u00a0<\/span><\/td>\nKorea Subway Info : Metroid<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.co.GoodTVBible<\/span>\u00a0<\/span><\/td>\nGOODTV<\/span>\ub2e4\ubc88\uc5ed\uc131\uacbd\ucc2c\uc1a1<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.co.happymobile.happyscreen<\/span>\u00a0<\/span><\/td>\n\ud574\ud53c\uc2a4\ud06c\ub9b0<\/span> – <\/span>\ud574\ud53c\ud3ec\uc778\ud2b8\ub97c<\/span> \ubaa8\uc73c<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.co.rinasoft.howuse<\/span>\u00a0<\/span><\/td>\nUBhind: Mobile Tracker Manager<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    mafu.driving.free<\/span>\u00a0<\/span><\/td>\n\uc2a4\ud53c\ub4dc<\/span> \uc6b4\uc804\uba74\ud5c8<\/span> \ud544\uae30\uc2dc\ud5d8<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1M+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.wtwoo.girlsinger.worldcup<\/span>\u00a0<\/span><\/td>\n\uc774\uc0c1\ud615<\/span> \uc6d4\ub4dc\ucef5<\/span>\u00a0<\/span><\/td>\n500K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.ac.fspmobile.cu<\/span>\u00a0<\/span><\/td>\nCU<\/span>\ud3b8\uc758\uc810\ud0dd\ubc30<\/span>\u00a0<\/span><\/td>\n500K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.appsnine.audiorecorder<\/span>\u00a0<\/span><\/td>\n\uc2a4\ub9c8\ud2b8<\/span> \ub179\uc74c\uae30<\/span> : <\/span>\uc74c\uc131<\/span> \ub179\uc74c\uae30<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.camera.catmera<\/span>\u00a0<\/span><\/td>\n\ucea3\uba54\ub77c<\/span> [<\/span>\uc21c\uc815<\/span> \ubb34\uc74c\uce74\uba54\ub77c<\/span>]<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.cultureland.plus<\/span>\u00a0<\/span><\/td>\n\uceec\uccd0\ud50c\ub7ec\uc2a4<\/span>:<\/span>\uceec\uccd0\ub79c\ub4dc<\/span> \ud61c\ud0dd<\/span> \ub354\ud558\uae30<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.dkworks.simple_air<\/span>\u00a0<\/span><\/td>\n\ucc3d\ubb38\ub2eb\uc544\uc694<\/span>(<\/span>\ubbf8\uc138<\/span>\/<\/span>\ucd08\ubbf8\uc138\uba3c\uc9c0<\/span>\/WHO \u2026<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.lotteworld.ticket.seoulsky<\/span>\u00a0<\/span><\/td>\n\ub86f\ub370\uc6d4\ub4dc\ud0c0\uc6cc<\/span> \uc11c\uc6b8\uc2a4\uce74\uc774<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.Monthly23.LevelUpSnakeBall<\/span>\u00a0<\/span><\/td>\nSnake Ball Lover<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.nmp.playgeto<\/span>\u00a0<\/span><\/td>\n\uac8c\ud1a0<\/span>(geto) – PC<\/span>\ubc29<\/span> \uac8c\uc774\uba38<\/span> \ud544\uc218<\/span> \uc571<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.note.app.memorymemo<\/span>\u00a0<\/span><\/td>\n\uae30\uc5b5\uba54\ubaa8<\/span> – <\/span>\uc2ec\ud50c\ud574\uc11c<\/span> \ub354<\/span> \uc88b\uc740<\/span> \uba54\ubaa8\uc7a5<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.player.pb.stream<\/span>\u00a0<\/span><\/td>\n\ud480\ube75<\/span> : <\/span>\uad11\uace0<\/span> \uc5c6\ub294<\/span> \uc720\ud29c\ube0c<\/span> \uc601\uc0c1<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.realbyteapps.moneya<\/span>\u00a0<\/span><\/td>\nMoney Manager (Remove Ads)<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.wishpoke.fanciticon<\/span>\u00a0<\/span><\/td>\nInssaticon \u2013 Cute Emoticons, K<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    marifish.elder815.ecloud<\/span>\u00a0<\/span><\/td>\n\ud074\ub77c\uc6b0\ub4dc\ub7f0\ucc98<\/span>\u00a0<\/span><\/td>\n100K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.dtryx.scinema<\/span>\u00a0<\/span><\/td>\n\uc791\uc740\uc601\ud654\uad00<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.kcld.ticketoffice<\/span>\u00a0<\/span><\/td>\n\ub9e4\ud45c\uc18c<\/span>–<\/span>\ubba4\uc9c0\uceec\ubb38\ud654\uacf5\uc5f0<\/span> \uc608\ub9e4<\/span>& \u2026<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.lotteworld.ticket.aquarium<\/span>\u00a0<\/span><\/td>\n\ub86f\ub370\uc6d4\ub4dc<\/span> \uc544\ucfe0\uc544\ub9ac\uc6c0<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.lotteworld.ticket.waterpark<\/span>\u00a0<\/span><\/td>\n\ub86f\ub370<\/span> \uc6cc\ud130\ud30c\ud06c<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.skt.skaf.l001mtm091<\/span>\u00a0<\/span><\/td>\nT map for KT, LGU+<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    org.howcompany.randomnumber<\/span>\u00a0<\/span><\/td>\n\uc22b\uc790<\/span> \ubf51\uae30<\/span>\u00a0<\/span><\/td>\n50K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.aog.loader<\/span>\u00a0<\/span><\/td>\n\ub85c\ub354<\/span>(Loader) – <\/span>\ud6a8\uacfc\uc74c<\/span> \ub2e4\uc6b4\ub85c\ub4dc<\/span> \uc571<\/span>\u00a0<\/span><\/td>\n10K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.gomtv.gomaudio.pro<\/span>\u00a0<\/span><\/td>\nGOM Audio Plus – Music, Sync l<\/span>\u00a0<\/span><\/td>\n10K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.NineGames.SwipeBrickBreaker2<\/span>\u00a0<\/span><\/td>\nSwipe Brick Breaker 2<\/span>\u00a0<\/span><\/td>\n10K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.notice.safehome<\/span>\u00a0<\/span><\/td>\n\uc548\uc2ec\ud574<\/span> – <\/span>\uc548\uc2ec\uadc0\uac00<\/span> \ud504\ub85c\uc81d\ud2b8<\/span>\u00a0<\/span><\/td>\n10K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    kr.thepay.chuncheon<\/span>\u00a0<\/span><\/td>\n\ubd88\ub7ec\ubd04\ub0b4<\/span> \u2013 <\/span>\ucd98\ucc9c\uc2dc\ubbfc\uc744<\/span> \uc704\ud55c<\/span> \uacf5\uacf5<\/span>\u00a0 \u2026<\/span>\u00a0<\/span><\/td>\n10K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.curation.fantaholic<\/span>\u00a0<\/span><\/td>\n\ud310\ud0c0\ud640\ub9ad<\/span> – <\/span>\uc544\uc774\ub3cc<\/span> SNS <\/span>\uc571<\/span>\u00a0<\/span><\/td>\n5K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.dtryx.cinecube<\/span>\u00a0<\/span><\/td>\n\uc528\ub124\ud050\ube0c<\/span>\u00a0<\/span><\/td>\n5K+<\/span>\u00a0<\/span><\/td>\nUpdated*<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.p2e.tia.tnt<\/span>\u00a0<\/span><\/td>\nTNT<\/span>\u00a0<\/span><\/td>\n5K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.health.bestcare<\/span>\u00a0<\/span><\/td>\n\ubca0\uc2a4\ud2b8\ucf00\uc5b4<\/span>–<\/span>\uc704\ud5d8\ud55c<\/span> \uc804\uc790\uae30\uc7a5<\/span>, \u2026<\/span>\u00a0<\/span><\/td>\n1K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.ninegames.solitaire<\/span>\u00a0<\/span><\/td>\nInfinitySolitaire<\/span>\u00a0<\/span><\/td>\n1K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.notice.newsafe<\/span>\u00a0<\/span><\/td>\n\uc548\uc2ec\ud574<\/span> : <\/span>\uc548\uc2ec\uc9c0\ub3c4<\/span>\u00a0<\/span><\/td>\n1K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.notii.cashnote<\/span>\u00a0<\/span><\/td>\n\ub178\ud2f0\uc544\uc774<\/span> for <\/span>\uc18c\uc0c1\uacf5\uc778<\/span>\u00a0<\/span><\/td>\n1K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.tdi.dataone<\/span>\u00a0<\/span><\/td>\nTDI News – <\/span>\ucd5c\ucd08<\/span> \ub370\uc774\ud130<\/span> \ub274\uc2a4<\/span> \uc571<\/span> \u2026<\/span>\u00a0<\/span><\/td>\n1K+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.ting.eyesting<\/span>\u00a0<\/span><\/td>\n\ub208\ud305<\/span> – <\/span>\uc5ec\uc790\ub4e4\uc758<\/span> \ucee4\ubba4\ub2c8\ud2f0<\/span>\u00a0<\/span><\/td>\n500+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.ting.tingsearch<\/span>\u00a0<\/span><\/td>\n\ud305\uc11c\uce58<\/span> TingSearch<\/span>\u00a0<\/span><\/td>\n50+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.celeb.tube.krieshachu<\/span>\u00a0<\/span><\/td>\n\uce04\uc2a4\ud2f1 : \ud06c\ub9ac\uc0e4\uce04 Fantastic<\/span>\u00a0<\/span><\/td>\n50+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
    com.player.yeonhagoogokka<\/span>\u00a0<\/span><\/td>\n\uc5f0\ud558\uad6c\uace1<\/span>\u00a0<\/span><\/td>\n10+<\/span>\u00a0<\/span><\/td>\nRemoved**<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    * Updated means that the recent application on Google Play does not contain the malicious library.<\/span>\u00a0<\/span><\/p>\n

    ** Removed means the application is not available on Google Play as of the time of posting.<\/span>\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications…<\/p>\n","protected":false},"author":695,"featured_media":167125,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1838,442],"tags":[],"coauthors":[4136],"class_list":["post-166994","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile-security","category-mcafee-labs"],"acf":[],"yoast_head":"\nGoldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-12T22:49:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-11-21T14:53:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea\",\"datePublished\":\"2023-04-12T22:49:01+00:00\",\"dateModified\":\"2024-11-21T14:53:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\"},\"wordCount\":1332,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png\",\"articleSection\":[\"Mobile Security\",\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\",\"name\":\"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png\",\"datePublished\":\"2023-04-12T22:49:01+00:00\",\"dateModified\":\"2024-11-21T14:53:05+00:00\",\"description\":\"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog","description":"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog","og_description":"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2023-04-12T22:49:01+00:00","article_modified_time":"2024-11-21T14:53:05+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png","type":"image\/png"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea","datePublished":"2023-04-12T22:49:01+00:00","dateModified":"2024-11-21T14:53:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/"},"wordCount":1332,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png","articleSection":["Mobile Security","McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/","name":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png","datePublished":"2023-04-12T22:49:01+00:00","dateModified":"2024-11-21T14:53:05+00:00","description":"Authored by SangRyol Ryu McAfee\u2019s Mobile Research Team discovered a software library we\u2019ve named Goldoson, which collects lists of applications installed,","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/04\/300x200_Blog_Goldoson-Man.png","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/166994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=166994"}],"version-history":[{"count":23,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/166994\/revisions"}],"predecessor-version":[{"id":205067,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/166994\/revisions\/205067"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/167125"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=166994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=166994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=166994"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=166994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}