A range of malicious adware apps have been found on the Google Play store by security researchers at  McAfee. It is estimated that 20 million installations across 16 different apps occurred before they were identified and subsequently removed from Google Play. These apps contained clicker malware, which runs in the background without the user’s knowledge. Clicker malware causes false click-through ad revenue to be paid to the threat actors behind the apps, by silently opening and clicking on advertising URLs.  

Most of these apps disguise themselves as useful applications, such as torches or QR code scanners, and contain the code to function effectively in these roles. However, when the apps are opened, an HTTP request is executed, triggering the download of its remote configuration. This registers a Firebase Cloud Messaging (FCM) listener, which receives push messages containing information about which function to call with what parameters. The FCM message typically contains a website URL, which are opened in the background, and ‘browsed’ in a way that mimics user behaviours. Heavy power consumption occurs on the device, as well as an influx of high traffic to the URLs, creating ad-click-through profit for the malicious actors, and poor device performance for the victims. 

Identified Adware App Names: 

• High-Speed Camera  
• Smart Task Manager  
• Flashlight+  
• 달력메모장  
• K-Dictionary  
• BusanBus  
• Flashlight+  
• Quick Note  
• Currency Converter  
• Joycode  
• EzDica  
• Instagram Profile Downloader 
• Ez Notes  
• 손전등  
• 계산기  
• Flashlight+  

Any users that recognise these android apps on any device should uninstall the app immediately. Users may become aware of the presence of this malware on their device due to the side effects of having constant background processes running. These include overheating and reduced battery life due to the increased workload, as well as an increase in mobile data usage if this permission has been configured for the malicious app in settings. Removing this type of malicious app from the device and deleting all the saved app’s data will remove these side effects as well as removing the malware itself.