Cybercrime
,
Endpoint Security
,
Fraud Management & Cybercrime
Researchers Identify 455 Malicious Apps Tied to Global Malvertising Campaign
Cybercriminals used malicious Android apps to funnel unwitting users to an ad fraud scam that generated up to 659 million daily bid requests, reports Human Security.
See Also: The Healthcare CISO’s Guide to Medical IoT Security
Dubbed Trapdoor by researchers, the ad fraud and malvertising scam has spanned 455 malicious Android apps and is linked to 183 threat actor-owned command-and-control domains.
Researchers said threat actors target cloth malicious apps as harmless utilizes such as PDF viewers, file managers or device cleanup tools. After downloading any one of the 455 threat actor-owned apps, the malvertising fraud pipeline begins.
The apps prompt users to download a slew of fake software updates, delivering a second-stage payload. Human researchers observed the secondary payload deploying hidden embedded browsers that load malicious HTML5 domains and content behind the scenes, generating fake ad impressions, user clicks and ad bid requests without the user’s knowledge.
The operation abuses and impersonates legitimate mobile advertising infrastructures and installs attribution services – tools utilized by real marketers – to evade user detection, said researchers. The malware also confirms where downloads originate from, enabling “malicious behavior only in users” who acquired apps “through threat actor-run ad campaigns.” The operators behind the campaign suppressed organic downloads.
The malicious apps simulate realistic user interactions such as taps, swipes or scrolling gestures and make fraudulent traffic appear legitimate on ad platforms. Portions of the campaign’s monetization techniques linked out to other ad fraud operations including Badbox 2.0 (see: FBI Warns of BADBOX 2.0 Botnet Surge in Chinese Devices).
Trapdoor has generated over 24 million fraudulent app installs, creating “a self-sustaining cycle of fraud,” said researchers, in which any revenue generated from previously run ads is fed back into new malvertising campaigns.
According to the report, Trapdoor’s malicious activity is mostly confined to the United States, but researchers also observed traffic crop up in Japan, Australia, Russia, New Zealand, India and several other locations.