Click-fraud malware found lurking in more than 50 Play Store apps

guest · Mar 24, 2020

Click-fraud malware found lurking in more than 50 Play Store apps
March 24, 2020
https://betanews.com/2020/03/24/click-fraud-malware-play-store/

Researchers at Check Point have identified an auto-clicker malware family operating inside the Google’s Play Store.

Disguised in over 56 applications and downloaded over 1,000,000 times globally, the malware -- dubbed 'Tekya' -- commits mobile ad fraud by imitating the actions of a user, clicking ads and banners from ad agencies like Google's AdMob, AppLovin', Facebook, and Unity.
Of the infected applications 24 targeted children, ranging from puzzles to racing games. The rest of the infected applications targeted users of utility applications, such as cooking, calculator, download, and translator apps.

"To us, the amount of applications targeted and the sheer number of downloads that the actor successfully infiltrated into Google Play is staggering," says Check Point's manager of mobile research, Aviran Hazum.
Click to expand...

Check Point researchers responsibly disclosed their findings to Google which was able to remove the infected apps and the threat from the Play Store by early March 2020.
Click to expand...

Check Point Research: Google Play Store Played Again – Tekya Clicker Hides in 24 Children’s Games and 32 Utility Apps

The Tekya malware obfuscates native code to avoid detection by Google Play Protect and utilizes the ‘MotionEvent’ mechanism in Android (introduced in 2019) to imitate the user’s actions and generate clicks.
During this research, the Tekya malware family went undetected by VirusTotal and Google Play Protect. Ultimately, it was available for download in 56 applications downloadable on Google Play.
Click to expand...

guest · Jun 8, 2020

New Tekya Ad Fraud Found on Google Play
June 5, 2020
https://blog.trendmicro.com/trendlabs-security-intelligence/new-tekya-ad-fraud-found-on-google-play/

In late March, researchers from CheckPoint found the Tekya malware family, which was being used to carry out ad fraud, on Google Play. These apps have since been removed from the store, but we recently found a variant of this family that had made its way onto Google Play via five malicious apps, although these have also been removed. (We detect these as AndroidOS_Tekya.HRX.)

This variant of Tekya shares many similarities with the previously found version. For example, the encryption remains essentially identical. The same algorithms and keys are used in both versions.
According to its code, Tekya would target up to 11 advertising networks, including: Admob, Facebook, and Unity. Advertisements from these networks would be displayed, and user touch events imitated through InputManager.
Click to expand...

We originally found several of these apps on Google Play, but Google removed these from the App Store while our research was underway. We are still watching for any similar threats that may emerge in the wild.
Click to expand...

Log in or Sign up

Click-fraud malware found lurking in more than 50 Play Store apps

guest Guest

guest Guest

Log in or Sign up

Click-fraud malware found lurking in more than 50 Play Store apps

guest Guest

guest Guest

Useful Searches