75 Android apps removed malicious adware from their code

Seventy-five Android apps, available for download from the official Google Play Store, had to remove a malicious ad library, which secretly contained an adware called AdDown, which was discovered by Trend Micro researchers two years ago.

This adware appeared in January 2015 and in addition to displaying advertisements to infected users, it also had the ability to collect personal data from its victims, and at one point it could even secretly install various applications without the user's knowledge.

Over time, Trend Micro reports that the adware was detected in over 800 Android apps uploaded to the Play Store, usually as small utilities, such as wallpaper changers, photo editors, and flashlights.

After an in-depth analysis of applications infected with AdDown over the past two years, researchers were able to identify three main stages of its evolution, named: Joymobile, Nativedown, and Xavier.

The first stage of adware's evolution was its simplest version, but it was also the one with the most annoying features, coming equipped with a method for installing third-party applications behind the user's back.

The second stage removed this installation method, leaving only one that required user approval, but improved on other features, such as comms encryption, internal string obfuscation, and user-based filtering for better ad personalization.

The third and final stage of AdDown was first detected in September 2016 and while it had generally improved features over the second stage, support for sandbox detection and avoidance was also added.

This version also removed the ability to install third-party applications, likely because the adware author realized that adware would have a better chance of going unnoticed if it showed ads occasionally, and not forced the applications to drown the user in ads.

Experts say that over the past two years, millions of users appear to have downloaded and installed apps infected with one of these three versions of the AdDown adware. Trend Micro researcher Ecular Xu said that AdDown was distributed to various app developers as an advertising SDK, which explains why it was found in so many apps. Xu published a list of apps that were previously infected but have now had AdDown removed from their code: