Advertising revenue depends on automated processes for buying and selling ads and paying based on views. These processes are also vulnerable to abuse, and that's exactly what happened.
On Tuesday, cases of fraud became known, where cybercriminals used more than 125 Android and websites to track and mimic user behavior, which were then used to generate millions of dollars through ad serving.
Google explained in a post that the botnet, called “TechSnab,” was deploying bots that visited websites to increase ad revenue. These bots would display ads in an invisible window to create fake traffic among the real traffic.
A front company called “We Purchase Apps” purchased legitimate apps from developers and transferred their ownership to a network of companies located in Cyprus, Malta, Croatia, Bulgaria, and other locations.
The ad fraud ring's masterminds tracked popular apps to include in their network. Once they acquired them, the apps were kept up to date to keep real users happy.
The purchased apps were used to train bots to monitor user behavior and act like humans, thus avoiding many controls and allowing their owners to become rich.
According to Google, “the botnet created hidden windows in the browser to increase ad revenue. The malware contained IP and data obfuscation, as well as defenses against censorship.”
The affected apps range from games to utility apps, such as smartphone flashlights and nutrition apps. Many of the affected apps were specifically designed for children.
