Many adware apps aggressively promoted on Facebook as system cleaners and optimizers for Android devices count millions of installs on the Google Play store.
See also: Play Store: Adware and malware are hiding in apps with thousands of downloads
The apps lack all the promised functionality and push ads while trying to last as long as possible on the device.
To avoid deletion, the apps hide on the victim's device by constantly changing icons and names, disguised in Settings or the Play Store itself.
Adware apps abuse the Android Contact Provider component, which allows them to transfer data between the device and online services.
The subsystem is called every time a new application is installed, so the adware may use it to start the ad serving process. To the user, it may appear that the ads are being promoted by the legitimate application they installed.
Researchers at McAfee discovered the adware applications. They note that users do not need to launch them after installation to see the ads because the adware starts automatically without any interaction.
The first action of these annoying applications is to create a persistent service to display ads. If the process is terminated, it is immediately restarted.
See also: Industrial Spy: New stolen data market promoted through adware
As McAfee comments in the report, users are convinced to trust adware apps because they see a Play Store link on Facebook, leaving little room for doubt.
This resulted in unusually high download numbers for this type of app, as shown in the list below:
Junk Cleaner, cn.junk.clean.plp, 1 million+ downloads
EasyCleaner, com.easy.clean.ipz, 100,000+ downloads
Power Doctor, com.power.doctor.mnb, 500,000+ downloads
Super Clean, com.super.clean.zaz, 500,000+ downloads
Full Clean -Clean Cache, org.stemp.fll.clean, 1 million+ downloads
Fingertip Cleaner, com.fingertip.clean.cvb, 500,000+ downloads
Quick Cleaner, org.qck.cle.oyo, 1 million+ downloads
Keep Clean, org.clean.sys.lunch, 1 million+ downloads
Windy Clean, in.phone.clean.www, 500K+ downloads
Carpet Clean, og.crp.cln.zda, 100,000+ downloads
Cool Clean, syn.clean.cool.zbc, 500K+ downloads
Strong Clean, in.memory.sys.clean, 500K+ downloads
Meteor Clean, org.ssl.wind.clean, 100,000+ downloads
See also: Mac: Adware and user fraud are the most common threats
Most affected users are located in South Korea, Japan , and Brazil, but the adware has unfortunately reached users all over the world.
The adware apps are no longer available on the Play Store. However, users who installed them must manually remove them from their device.
