If you didn't think it was possible for ads to become any more infuriating, then you are a) optimistic and b) wrong.
Cybersecurity firm Symantec has discovered two malicious apps in which hidden ads are being automatically clicked to generate revenue for threat actors.
This newly discovered tactic uses embedded advertisements – strategically positioned beyond a mobile device’s viewable screen area – to initiate an automated ad-click process.
The ghost-clicking action, which goes on out of sight and without the knowledge of the device user, drains batteries, slows performance and potentially increases mobile data usage by secretly sending the user on frequent visits to websites connected with the ads.
This underhanded sneakery was spotted taking place on devices that had downloaded the notepad app Idea Note and the fitness app Beauty Fitness, both of which were available on the Google Play Store.
The apps, published by a developer known as Idea Master, have a collective download count of 1.5 million users.
The cunning creators of the apps packed the apps using legitimate hackers originally developed to protect the intellectual property of Android applications. Android packers can change the entire structure and flow of an Android Package Kit (APK) file, making it difficult for security researchers who want to decipher the APK’s behavior.
This complexity in design, together with the hidden nature of the ad clicking, allowed the apps' malicious activities to go unnoticed on Google Play for nearly a year.
Symantec has informed Google of the observed behavior and the apps have now been removed from the Play Store.
Users of Idea Note: OCR Text Scanner, GTD, Color Notes and Beauty Fitness: daily workout, best HIIT coach are advised to manually uninstall them from their devices.
A spokesperson for Symantec advised app users to only install apps from trusted sources and to install a mobile security app to protect their device and data.