Cybersecurity technology company Bitfinder identified a new malware campaign that involves thirty-five (35) malicious Android applications uploaded to the Google Play Store. Researchers employed a real-time behavior-based analysis method that identified the campaign and discovered that the applications have been installed over 2 million times on victims’ mobile devices. The mobile applications lure users by offering fraudulent “specialized functionality” but once installed, immediately change their names and icons in order to conceal their presence and make the uninstall process more difficult. The app developers also push updates to the apps to advance their persistence abilities. The apps then serve the victims various intrusive advertisements by abusing “WebView”, which generates “fraudulent impressions and ad revenue for their operators.” The apps offer advertisements to their users via their own frameworks which also allow malware to be served. Researchers noted one example of a “GPS Location Maps” app that, once installed, changes its name to “Settings”, declared an alias launcher, and immediately shows additional websites in WebViews as well as an advertisement. Once the icon is clicked, the alias launcher renders this activity with “a “0” size in a corner, then launches the settings page for the phone, tricking the user into thinking that the real settings button was pressed.” This app has zero (0) reviews and over 100,000 downloads. Other applications disguise themselves as Motorola, Oppo, and Samsung system apps. Various functionalities, such as heavy code obfuscation, encryption, and excluding the app from the devices’ “Recent apps” list, are present to bypass detection and complicate reverse engineering efforts. As of August 18, 2022, three (3) of the thirty-five (35) applications are still available in Google Play Store: “Walls light – Wallpapers Pack”, “Animated Sticker Master”, and “GPS Location Finder”. A full list of malicious applications as well as a deeper dive into the technical aspects of this campaign can be viewed in Bitdefender’s report linked below.