Dr.WEB reports ad networks , spreading malware for Android

As per an announcement made by Dr.WEB, it has warned users against malicious adware module incorporated in twenty-eight applications on Google Play. These have been detected by Dr.WEB to spread Trojans malware. As per the company, the total number of installations of these programs has reached several million.

Android.SmsSend programs designed to send short messages to premium numbers and subscribe users to chargeable services are the most popular among them these malware. However, Dr. WEB reported the list of malware being spread is expanding.

Despite the fact that ad networks like Google AdMob, Airpush, and Startapp meet criminals' demands, intruders decided to go even further and created an ad network of their own. At first sight, it appears quite similar to others:

The advertisement API provides push notification ads that deliver small alerts to an Android phone's notification bar.

An investigation conducted by Dr.WEB's analyst revealed that such apk-files contain Android.SmsSend Trojans. Analysts also found that these malicious programs were being downloaded from various fake application catalogues. The ad module in three analyzed applications would connect to a control server at 188.139.xxx.xx, while the module in the remaining 25 apps would try to connect to a server at 91.226.xxx.xx. To get the respective sites blocked, the IP addresses were promptly added to the Dr.WEB Parental Control database.

The advertising API is particularly dangerous because applications that use it are found on Google Play, which is the safest source of programs for Android.