New Family of Deceptive Gaming Apps Discovered

guest · Oct 9, 2020

New Family of Deceptive Gaming Apps Discovered
October 9, 2020
https://www.infosecurity-magazine.com/news/new-family-of-deceptive-gaming/

A new family of gaming apps that uses out-of-context (OOC) ads to deceive users has been discovered on the Google Play Store.

While fulfilling their advertised function to varying degrees, the apps run ads that appear to be coming from popular applications and social media platforms including YouTube and Chrome.
The brood of more than 240 deceptive Android apps was detected by the White Ops Satori Threat Intelligence and Research Team. Many of the apps are little more than Nintendo emulators that researchers say were "ripped from legitimate sources or low-quality games."

The assortment of deceptive apps was dubbed RAINBOWMIX by researchers as a nod to the vibrant 8–16bit color palette deployed in retro games. The family garnered more than 14 million downloads before being removed from the Google Play Store.
Click to expand...

Researchers observed that at its peak, RAINBOWMIX had more than 15 million ad impressions per day.

All of the apps discovered seem to possess fairly low detection ratings across AV engines, largely because of the packer being used," noted researchers.
RAINBOWMIX tracked when users turned their screens on and off to determine the best moment for an ad to pop-up. Most of the ad traffic shown to users came from Brazil, Indonesia, Vietnam, and the United States.
Click to expand...

White Ops: Somewhere over the RAINBOW(MIX)

While not a very sophisticated tactic, the use of packers allowed these apps to bypass certain security protocols.

The code responsible for the out of context ads is located in spoofed/illegitimate versions of legitimate SDKs, such as Unity and Android. For clarity, this investigation did not detect any fraud directly tied to such legitimate SDKs. All of the apps discovered seem to possess fairly low detection ratings across AV engines, largely because of the packer being used. App IDs can be found in the Appendix.
Click to expand...

Log in or Sign up

New Family of Deceptive Gaming Apps Discovered

guest Guest

Log in or Sign up

New Family of Deceptive Gaming Apps Discovered

guest Guest

Useful Searches