Google Play Store malware targets porn ads at millions of kids

The malicious code is hidden inside 60 game apps downloaded 'millions of times'

A fresh malware found on theGoogle Play Storedisplays pornographic ads and tries to trick users into installing fake security apps'.

To make matters even worse, the malicious code is said to hide itself inside around 60 game apps, many of which are intended to be used by children, and which have been downloaded between 3 million and 7 million times, the researchers who discovered it said.

Those researchers, fromsecurity firm Check Point Research, said the malware - dubbed AdultSwine' - also induces users to register to premium services at their own expense.

Here's how it works: First, the malicious code contacts its Command and Control (C&C) server to report the successful installation, sends data about the infected device and then receives the configurations, which determine its course of operation.

"These configurations instruct it on whether to hide its icon, which ads to display, over which apps and on what terms," Check Point's researchers explained.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"The malicious code then verifies certain conditions regarding the device's status and checks which app is currently running on screen. Once all its terms are met, it begins to display the illegitimate ads outside of the app's context."

If it is embedded inside a web browser app, the ads will be displayed inside that browser, and if not, they will be displayed inside a designated web view, Check Point said.

"As for the ads being displayed, they come from two main sources; the first is that of the main ad providers, which forbid such illegitimate display of their ads. The second is the malicious code's own ad library, which contains ads of an offensive nature, including pornographic ads."

All of these Check Point highlighted - are displayed to children while playing the game that the app is masquerading as.

"The malicious code can use [also] its infrastructure to broaden its goals to other purposes, such as credential theft," explained Check Point. "Once the malicious app is installed on the device, it waits for a boot to occur or for a user to unlock his screen, upon which it initiates its malicious activity."

Advertisement - Article continues below

"We've removed the apps from Play, disabled the developers' accounts, and will continue to show strong warnings to anyone that has installed them," a Google spokesperson toldReuters.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

23 Dec 2019
Visit/antivirus/28144/best-antivirus
antivirus

Best antivirus for Windows 10

3 Sep 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/data-protection/354492/currys-pc-world-parent-firm-hit-with-ps500k-fine-over
data protection

Currys PC World parent firm hit with £500k fine over historic data breach

9 Jan 2020
Visit/security/ransomware/354483/travelex-disruption-caused-by-devastating-ransomware-attack
ransomware

Travelex disruption caused by devastating ransomware attack

8 Jan 2020