The Google Play Store has been infected with 43 Android with 2.5 million installs that display hidden ads while a phone's screen is off, draining the device's battery.
See also: Google Play: Tests feature that shows what an app looks like on different types of devices
McAfee's mobile research team discovered malicious Android apps and reported them to Google, as they violated Google Play Store policies. Google subsequently removed the apps from the official app store.
The apps, which primarily offered media and news feeds, targeted Korean users. However, the same deceptive tactics can easily be applied to other app categories and different user demographics.
Although these applications are considered adware, they still pose a risk to users, as they open the door to potential risks such as creating user profiles, draining the battery , consuming significant internet data, and committing fraud against advertisers.
According to McAfee's report, the adware was found in Google Play apps that pretended to be TV/DMB Player, Music Downloader, News, and Calendar apps. Once installed on a device, the adware apps wait several weeks before activating ad fraud, with the aim of deceiving users and avoiding detection by Google.
McAfee says the adware's configuration can be modified and updated remotely via Firebase Storage or Messaging, allowing operators to adjust the inactivity period and other parameters.
See also: Google Play will impose business controls to limit malware submissions
Android uses a power-saving feature that puts an app into standby mode when a device is not in use, preventing it from running in the background and consuming CPU, memory, and network resources.
When malicious adware apps are installed, they ask users to add them as an exception to Android's power saving system, allowing the malicious apps to run in the background. This exception allows the adware apps to retrieve and load ads even when the screen is off, generating revenue secretly while users are unaware that this is happening.
According to McAfee, users may experience the problem of loading ads appearing on a device screen before they automatically close. However, the most reliable indicator of a breach remains inexplicably high battery consumption during device inactivity.
To check which apps are consuming the most power on your Android device, go to “Settings → Battery → Battery Usage”, where you will find information about overall usage and background usage.
McAfee reports that adware applications ask for permission to access other applications, commonly used by banking Trojans that overlay phishing pages over legitimate online banking applications. However, no phishing cases were observed in this scenario.
See also: Google Play: Changes policy for blockchain-based apps
Google Play is Google's official app store available for devices running the Android operating system. Apart from apps, it also offers books, music, movies, and TV shows. When it comes to apps, Google Play offers thousands of different options, both free and paid, categorized into various genres such as Education, Entertainment, Games, Communication, and many more. Despite the benefits of a wide variety of apps, it is recommended that Android users always read reviews before installing apps and carefully consider the permissions required when installing new apps before allowing them to install.
