{"id":77134,"date":"2017-08-24T17:59:02","date_gmt":"2017-08-25T00:59:02","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=77134"},"modified":"2025-05-27T20:45:49","modified_gmt":"2025-05-28T03:45:49","slug":"android-click-fraud-apps-briefly-return-google-play","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/","title":{"rendered":"Android Click-Fraud Apps Briefly Return to Google Play"},"content":{"rendered":"<p>Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that simulates clicks is similar to the behavior of many legitimate applications (using common API calls and permissions). Further, part of the malicious code does not reside in the original malware and comes from a control server. Using special methods to perform the clicking allows the attackers to decide when and how pursue their fraud.<\/p>\n<h2>Android\/Clickers<\/h2>\n<p>The McAfee Mobile Malware Research Team recently found on Google Play a group of Android\/Clickers published by the developer \u201cTubeMate 2.2.9 SnapTube YouTube Downloader J.\u201d Five apps were updated on Google Play on August 4 and were removed a few days later, along with the developer profile.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77225 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\" alt=\"\" width=\"1917\" height=\"817\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png 1917w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c-300x128.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c-768x327.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c-1024x436.png 1024w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c-1173x500.png 1173w\" sizes=\"auto, (max-width: 1917px) 100vw, 1917px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>By checking \u201ccom.ggnegmth.app\u201d on GooglePlay we saw something suspicious in this application: a nonsense name, no description, and poorly reviewed. Of course, those traits do not guarantee an app is malicious, but this lineup should serve as a warning for Android users looking for new apps.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77226 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c.png\" alt=\"\" width=\"1432\" height=\"1540\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c.png 1432w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c-279x300.png 279w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c-768x826.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c-952x1024.png 952w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-2c-465x500.png 465w\" sizes=\"auto, (max-width: 1432px) 100vw, 1432px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Analyzing and reverse engineering this sample shows us a DeviceAdminReceiver class that connects to a hardcoded URL to obtain parameters that indicate how and where to perform click-fraud activities:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-3.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77138 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-3.png\" alt=\"\" width=\"768\" height=\"681\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-3.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-3-300x266.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-3-564x500.png 564w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><\/a><\/p>\n<p><em>This function is part of a service initiated by a receiver related to DeviceAdmin.<\/em><\/p>\n<p>Once the URL is requested, the control server returns an HTML page with the parameters in an uncommon way\u2014inside the title tag, as we see in the following:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-4.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77140 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-4.png\" alt=\"\" width=\"604\" height=\"311\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-4.png 604w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-4-300x154.png 300w\" sizes=\"auto, (max-width: 604px) 100vw, 604px\" \/><\/a><\/p>\n<p>All the parameters are in one line, but the malware interprets them using the string \u201ceindoejy\u201d to separate them, obtaining the target URL, JavaScript functions to perform clicks, HTTP headers used in the fraudulent HTTP request, and another Google Play package to monetize the clicks in the abused ad network. We thought that string \u201ceindoejy\u201d could be an anagram of \u201cI enjoyed\u201d or \u201cdie enjoy,\u201d but we found other variants in which the word used to split the parameters is different.<\/p>\n<p>Once installed, Android\/Clicker.BN adds an icon to the main menu that is not related to the downloaded app from Google Play. The new icon appears to be a system utility. Some examples of the icons loaded by the malware:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77141 size-full\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5.png\" alt=\"\" width=\"1025\" height=\"307\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5.png 1025w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5-300x90.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5-768x230.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-5-1024x307.png 1024w\" sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><\/a>When Android\/Clicker.BN executes, it requests device administration privileges:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-77142\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6-180x300.png\" alt=\"\" width=\"296\" height=\"493\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6-180x300.png 180w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6-614x1024.png 614w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-6-300x500.png 300w\" sizes=\"auto, (max-width: 296px) 100vw, 296px\" \/><\/a><\/p>\n<p>Some of the apps can access YouTube inside a WebView and list trending channels, others lock and blacken the screen, and others crash the UI while in the background running click fraud\u2014which not only harms advertisers and publishers, but also generates malicious traffic on infected devices, impacts battery and overall usage performance, and opens the door to new malicious payloads.<\/p>\n<p>McAfee Mobile Security detects this threat as Android\/Clicker.BN!Gen and prevents its execution. To further protect yourself against malicious apps, use only legitimate app stores, and pay attention to suspicious traits such as nonsense names, missing descriptions, and poor reviews. Also verify that the app\u2019s request for permissions are related to its functionality. Be wary when apps request device administration API access, which is usually requested only by security apps, antimalware, mobile device management, or corporate email clients. Most apps and games will never ask for device admin rights.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior&#8230;<\/p>\n","protected":false},"author":833,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,76,214],"coauthors":[2035],"class_list":["post-77134","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-cybercrime","tag-mobile-security1"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-08-25T00:59:02+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T03:45:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1917\" \/>\n\t<meta property=\"og:image:height\" content=\"817\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Fernando Ruiz\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Ruiz\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\"},\"author\":{\"name\":\"Fernando Ruiz\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922\"},\"headline\":\"Android Click-Fraud Apps Briefly Return to Google Play\",\"datePublished\":\"2017-08-25T00:59:02+00:00\",\"dateModified\":\"2025-05-28T03:45:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\"},\"wordCount\":538,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\",\"keywords\":[\"android\",\"cybercrime\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\",\"name\":\"Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\",\"datePublished\":\"2017-08-25T00:59:02+00:00\",\"dateModified\":\"2025-05-28T03:45:49+00:00\",\"description\":\"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Android Click-Fraud Apps Briefly Return to Google Play\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922\",\"name\":\"Fernando Ruiz\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5b6dec450e97e87f9a57fae15bae5d34\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g\",\"caption\":\"Fernando Ruiz\"},\"description\":\"Fernando Ruiz is a Security Researcher in McAfee Labs. He specializes in mobile threats and Android malware. Ruiz performs deep analysis and reverse engineering of malicious code, packers, and vulnerabilities; and creates detection technologies to proactively protect people against a wide spectrum of malware and potentially unwanted programs.\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/fernando-ruiz\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog","description":"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog","og_description":"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2017-08-25T00:59:02+00:00","article_modified_time":"2025-05-28T03:45:49+00:00","og_image":[{"width":1917,"height":817,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png","type":"image\/png"}],"author":"Fernando Ruiz","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Fernando Ruiz","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/"},"author":{"name":"Fernando Ruiz","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922"},"headline":"Android Click-Fraud Apps Briefly Return to Google Play","datePublished":"2017-08-25T00:59:02+00:00","dateModified":"2025-05-28T03:45:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/"},"wordCount":538,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png","keywords":["android","cybercrime","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/","name":"Android Click-Fraud Apps Briefly Return to Google Play | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png","datePublished":"2017-08-25T00:59:02+00:00","dateModified":"2025-05-28T03:45:49+00:00","description":"Click-fraud apps frequently appear on Google Play and third-party markets. They are sometimes hard to identify because the malicious behavior that","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/08\/20170824-Click-fraud-1c.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-click-fraud-apps-briefly-return-google-play\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Android Click-Fraud Apps Briefly Return to Google Play"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/0ed97a1d0ce0c90c2a9ef2fbab555922","name":"Fernando Ruiz","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5b6dec450e97e87f9a57fae15bae5d34","url":"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7fa953f9b978dc1f77d7abb273aa5ec1?s=96&d=mm&r=g","caption":"Fernando Ruiz"},"description":"Fernando Ruiz is a Security Researcher in McAfee Labs. He specializes in mobile threats and Android malware. Ruiz performs deep analysis and reverse engineering of malicious code, packers, and vulnerabilities; and creates detection technologies to proactively protect people against a wide spectrum of malware and potentially unwanted programs.","url":"https:\/\/www.mcafee.com\/blogs\/author\/fernando-ruiz\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/77134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/833"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=77134"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/77134\/revisions"}],"predecessor-version":[{"id":214519,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/77134\/revisions\/214519"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=77134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=77134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=77134"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=77134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}