Google Play is said to have at least 17 apps that are part of a family of Trojans called HiddenAds if you believe in cybersecurity company Avast. The apps are found to be part of a large HiddenAds campaign that initially targeted users in India and Southeast Asia. The Avast researchers found that these applications are masked as games, but are designed to display intrusive ads and can steal users’ personal information. The researchers noted that Trojan apps have the ability to hide their icons from affected devices and display timed ads that cannot be ignored.
The Avast team of researchers initially discovered a total of 47 applications belonging to the HiddenAds family of Trojans. Google, however, removed 30 of those applications upon receiving the report from the antivirus company.
“Once the user downloads the application, a timer starts inside the application. The user can play for a specified period of time, after which the timer activates the application’s hide icon function,” explained Avast Threat Operations Analyst Jakub Vávra, in a blog post. “Once the icon is hidden, the app starts displaying ads across the device without the need for additional user action.”
Some of the Trojan apps discovered by the Avast team are claimed to even open the browser to display intrusive ads to users. Since apps hide their icon after a certain time limit, their victims cannot understand the origin of the ads they see on their devices. That said, Trojan apps can still be uninstalled through the device’s app manager.
The Avast team found that each of the discovered apps has a separate developer that appears on Google Play, with a generic email address. “Similarly, the Terms of Service are identical across all discovered applications, likely targeting a campaign organized by an actor,” added Vávra.
In total, applications carrying Troyan HiddenAds have been downloaded over Rs 1.5 million. Some of the most downloaded titles that were alive at the time of the presentation of this story include Skate Board – New, Find Hidden Differences, Hidden Spot Differences, Tony Shoot – NEW and Stack Boys.
The researchers found that the HiddenAds campaign via apps was more frequent in Brazil, India, and Turkey. However, it also spread to other regions.
An email sent to Google did not generate a response at the time of posting this story.
Not the first time
This is not the first time that Google Play has been found to have applications that have the potential to steal user information. In July of last year, Avast detected apps that were installed 1,30,000 times combined with the nature of the stalking of users. Bot mitigation company White Ops in its research article published earlier this month also revealed that Google removed at least 38 apps from its Google Play store infecting Android devices with out-of-context ads.
As Vávra mentioned in a statement aware of GamesIndustry.biz it is indeed difficult for Google to avoid adware campaigns as there are unique developers for each application. “Campaigns like HiddenAds can enter the Play Store by obfuscating its true purpose or by slowly introducing malicious features once users have already downloaded them,” the analyst said.
Steps to stay away from such apps
Avast has advised users to carefully search for app request permissions before installing them on their devices. It is also important to take some time and read the privacy policy and the terms and conditions of the applications that are installed. Additionally, users are encouraged to reconsider downloading the app which has received a lot of negative reviews.
She is a freelance blogger, writer, and speaker, and writes for various entertainment magazines.