More than 50 apps found on the Google Play Store have infected an estimated 55 million Android users with adware. This is something that seems to be happening for the fifteenth time.
According to security researchers at Sophos, Android XavirAd has been detected in multiple apps on the Play Store. The adware displays intrusive ads to infected users and collects personal information that is sent to a remote server. Up to 55 million users are believed to have been infected so far.
Some of the 50 Google Play apps containing the adware have over a million downloads. Overall, the number of downloads rises to around 55 million.
Due to the adware, users see a full-screen advertisement at regular intervals, even if the infected application is closed. These advertisements will direct you to install other applications.
The Google Play Store is full of complaints about these apps, as many users noticed and reported the outrageous behavior.
“However, XavirAd can do much more than just display ads. After the application is launched, the XavirAd library contacts its server and gets the configuration code. The server responds with settings for displaying full-screen ads and stores them in the shared preferences. The domain api-restlet.com is allegedly registered for this purpose,” Sophos researchers point out.
The adware then uploads another .dex file from cloud.api-restlet.com, which collects data from the user's phone, such as the email address for the Google account, the list of installed applications, the IMEI and AndroidID, the screen resolution, the manufacturer, the brand and version of the operating system, SIM card information, and from the applications. The data is encrypted and sent to the C&C server.
List of infected applications
