A White Ops report details how thirty-eight apps - most of which are selfie apps that add filters to users' pictures - engaged in fraudulent ad activity and made it difficult for most users to uninstall the app from their devices.
The activity, which falls afoul of Google's policies, included:
- Out-of-Context (OOC) Ads: Rendering OOC ads including native and interstitial, from major ad-networks.
- Out-of-Context Navigation: Launching out-of-context navigation intents to URLs received from the command and control server (C2).
- Removal of App Icon: Remove the app icon from the device's home and apps folder, to make it difficult for the user to uninstall the app.
In addition to showing ads on Android even when not in use and hijacking ad screens from other apps, the apps also hid in the operating system so that they could not be easily removed by less experienced users who can't navigate through Android settings easily.
Here is a complete list of the offending apps and their download tally before removal:
- Yoroko Camera - 100k installation
- Cell Camera - 500k installation
- Lite Beauty Camera - a million installations
- Beauty Collage Lite - 500k installation
- Beauty & Filters Camera - a million installations
- Photo Collage & Beauty Camera - 100k installations
- Beauty Camera Selfie Filter - 10k installation
- Gaty Beauty Camera - 500k installation
- Pand Selfie Beauty Camera - 50k installation
- Caoon Photo Editor & Selfie Beauty Camera - a million installs
- Benbu Selfie Beauty Camera - one million installations
- Stacks Selfie Beauty Camera & Photo Editor - one million installations
- Mood Photo Editor & Selfie Beauty Camera - 500k installation
- Rose Photo Editor & Selfie Beauty Camera - a million installations
- Selfie Beauty Camera & Photo Editor - 100k installation
- Fog Selfie Beauty Camera - 100k installation
- First Selfie Beauty Camera & Photo Editor - 500k installation
- Vanu Selfie Beauty Camera - 100k installation
- Sun Pro Beauty Camera - one million installations
- Funny Sweet Beauty Camera - 500k installation
- Little Bee Beauty Camera - a million installations
- Beauty Camera & Photo Editor Pro - one million installations
- Grass Beauty Camera - a million installations
- Gesture Beauty Camera - a million installations
- Flower Beauty Camera - 100k installation
- Best Selfie Beauty Camera - A Million Installations
- Orange Camera - 500k installation
- Sunny Beauty Camera - a million installations
- Pro Selfie Beauty Camera - 500k installation
- Selfie Beauty Camera Pro - a million installations
- Elegant Beauty Cam-2019 - 50k installation
To read more about how the fraudulent apps operated, read the original White Ops Article which covers the analysis done by the White Ops Satori Threat Intelligence and Research Team.
Written by: James Delahunty @ 17 Jun 2020 19:21
