A digital security firm announced Tuesday that seven Adware scam apps found in Google Play and Apple’s App Store corralled over half a million dollars for their developers.
After a 12-year-old girl flagged a suspicious app promoted on a TikTok profile via its “Be Safe Online” project in the Czech Republic, where the company is located, Avast discovered the malicious software.
Avast announced in an official blog that the adware scam apps have been downloaded more than 2.4 million times and have gained their developers more than US$ 500,000.
On at least three accounts, several of the apps are promoted on TikTok, one with more than 300,000 followers, Avast observed. An Instagram user supporting one of the apps, with more than 5,000 followers, was also identified.
Avast clarified that the programs act as entertainment apps, showing commercials vigorously or charging $2 to $10 to buy the software.
Adware Scam Apps like HiddenAds, Trojans mask themselves as secure apps but serve ads outside the apps and promote other brands and programs.
“The scam apps we discover are fraudulent and violate the policies of both Google and Apple, either by making misleading claims about the functionality of the app or by placing advertisements outside the app and by installing the app and then soon hides the original app icon.” said, Jakub Vávra, a threat analyst at Avast.
He added, “This is especially true of popular applications among young children being promoted on social media platforms, which may not recognize the red flags around the apps, and that is why they Can fall for.”
Adware Scam Apps are Hard to Detect
HiddenAds trojans can be incredibly destructive because even after the app installed them is disabled, they can continue displaying ads.
Jonathan Tanner, a senior security researcher at Barikoda Networks, explains, “The practice of installing adware separately through the original application is that it is classified as a Trojan, not just adware.”
“The original app allows the user to infect their device with the original adware instead of acting as adware,” he said.
The Adware Scam Apps should be easier to detect because it is side-loading its adware and not serving its advertisements. Still, it reduces its profile by restricting itself to only legitimate programs’ features and nothing more.
“Normally, this would be a good way to detect malware,” Tanner said. “Malware also demands more power over the device than developers have available, also requiring more easily detectable rooting of the phone.”
Check out: 11 malicious apps that you should delete to protect your smartphone.
Adware can be challenging to identify in general since advertising is prevalent inside scam apps. “Adware takes these advertisements too far by either being too intrusive to exhaust the power and bandwidth of computation or using less trustworthy ad networks that can spread malware,” explained Tanner.
“This would involve profiling the actions of the app or reverse-engineering its code, both of which can be difficult and time-consuming to do at scale, to detect intrusive ads versus a simple banner,” he said.
“To detect malicious ad networks, it is important to find out which ad networks are legitimate and which are not, which are not trivial again,” he added. “Like apps themselves, ad networks can suddenly become more malicious than secure if the wrong ad signs up and has a lot of freedom over what content is allowed.”
Cowed by Influencers
It can be hard for an app store to flag programs that charge money but offer little or no functionality if they adhere to their claims, no matter how paralyzed.
“For instance, during the early days of the life of the App Store, the rise of flashlight apps was largely legitimate if a questionable value for the money,” said Chris Clements, vice president of solution architecture at Cerberus Sentinel, a cybersecurity consulting and penetration testing company in Scottsdale, Arizona.
“Since then, Apple and Google stores have tried to crack down on apps that only execute trivial functions,” he said, “but for reviewers to decide the concept of what constitutes a trivial function can be confusing.”
Inexperienced users may also find it more comfortable for suspicious apps to function. For most users, mobile devices are a ‘black box,’ and they have little insight into what’s going on more in-depth in the system, “said Saryu Nayyar, CEO of El Segundo, Calif, a threat intelligence company in El Segundo, Calif.
She said, “There is a range of methods that mobile app developers can use to conceal from a casual user.
Users on networks like TikTok can too easily cow social media celebrities. “Some social media influencers would take money without doing any research into their credibility to support goods or applications,” Clements maintained.
“The influencer network is ultra-competitive, and advertisements can be purchased for almost nothing from even those with broad audiences,” he said.
The benefit of social conditions
Ben Pick, a senior application security consultant at nVisium (a Falls Church, Va-based application security provider), noted that TikTok profiles’ use to advertise scam apps is just the latest misuse vector standard networks to seize revenues from unsuspecting supporters.
He said, “The safest way not to be susceptible is to search the app being downloaded and not select a link directly from the profile of a user.”
“To stop installing similar scams or outright malicious software, check for excessive permissions and multiple bad reviews,” he said.
The eventual banning of TikTok by the Trump administration, which faded away when the social media app was willing to cut a deal with Oracle and Walmart that pleased Washington, may have been another factor affecting downloading these malicious adware applications.
San Francisco-based mobile phishing solution provider San Francisco-based Hank Schlesworth, a senior manager of security solutions at Lockout, observed, “We often see intimidating actors taking advantage of social situations. ۔”
In this case, “they know that people arrived to download Tik Tok before the ban, and when they sign up for the app, it’s impressive for new users.” People follow. “
Always see reviews before downloading to identify Adware Scam Apps
Reading feedback for an app is one of the best ways to avoid being victim of adware scams. “It’s important to read reviews by other users and check the ratings when downloading apps,” James McQuiggan, a security awareness advocate at KnowBe4, says.
Pay special attention to negative reviews, added Cerberus Sentinels Cleats. “Scammers often use bots or pay for fake positive reviews,” he explained.
McQuiggan also recommended that it is essential to do thorough research on the app to ensure it is not Adware Scam Apps when there are prompts to install an app from an ad in a profile or website.
Check out: Apple deleted Thousands of Games Apps from the Chinese app store