Security firm Avast discovered at least 26 Android apps on the Google Play Store that contained adware that delivered advertisements to affected systems. The apps used a sophisticated technique that made it harder for users to remove the malware.
The apps were based on the Cordova framework and used different developer names in an attempt to avoid being simultaneously removed by Google. Many of them even recorded several thousand downloads.
But let's see how these types of apps work. Once downloaded to an Android device, they automatically remove app icons from the home screen to mislead users so they don't understand which app is causing the malicious behavior.
Then, they start displaying ads even on the home and lock screens, while also collecting information such as the Android operating system version. All information is sent to a remote server.
Avast believes that the information the apps sent back to the server was not used to spy on the user. Instead, the adware's administrators allegedly wanted to make sure that the phone was properly configured to send payloads or to ensure that ads were displayed correctly.
Google has already removed all of these apps from the Google Play Store, and users who want to uninstall them must do so from the Store, since the icon on the home screen has already disappeared.
