McAfee security researchers have discovered 16 malicious apps that managed to infiltrate Google Play, the official Android.
See also: Truth Social: Received approval to be listed on the Google Play Store
apps of adware that loads ads in invisible frames or in the background and clicks on them to generate revenue for their operators.
This can affect a device with decreased performance, overheating, increased battery usage, and inflated mobile data charges.
All 16 apps were removed from Google Play after being reported by McAfee. However, they have been installed 20 million times.
The most widespread is DxClean, which was installed five million times before being removed. It had a relatively positive overall user rating of 4.1 out of 5 stars.
DxClean was presented as a system cleaner and optimizer, promising to detect the causes of system slowdowns and stop annoying ads, while performing the exact opposite actions in the background.
See also: Adware: Ad-fraud apps found in Play Store and App Store
After launching, applications download their configuration from a remote location via an HTTP and register an FCM (Firebase Cloud Messaging) to receive push messages.
These messages contain instructions for people who click, such as which features and parameters to use.
The auto-click feature is managed by the "click.cas" component, while the agent that manages the hidden adware services is "com.liveposting".
McAfee analysts say the SDK can also work on its own, possibly to generate ad impressions only, but recent versions of Google Play apps feature both libraries.
The victim never interacts with open websites and is unlikely to be aware of the underground processes that generate profits for remote operators.
To avoid being noticed by the user, the malicious operation does not start in the first hour after installing the application, but delays its launch until the user is actively using the device.
See also: Chrome's "Internet Download Manager" turned out to be adware
Some ways to find out if there are any such apps on your device are to check your battery and internet usage. If the system has been unused for some time, there is no excuse for more battery drain and increased data consumption.
For the full list of 16 apps, see the breach indicators section at the bottom of McAfee.
