Particulars have emerged a few “huge advert fraud operation” that leverages a whole bunch of apps on the Google Play Retailer to carry out a number of nefarious actions.
The marketing campaign has been codenamed Konfety – the Russian phrase for Sweet – owing to its abuse of a cell promoting software program growth equipment (SDK) related to a Russia-based advert community referred to as CaramelAds.
“Konfety represents a brand new type of fraud and obfuscation, through which risk actors function ‘evil twin’ variations of ‘decoy twin’ apps accessible on main marketplaces,” HUMAN’s Satori Menace Intelligence Crew mentioned in a technical report shared with The Hacker Information.
Whereas the decoy apps, totaling greater than 250 in quantity, are innocent and distributed through the Google Play Retailer, their respective “evil twins” are disseminated by means of a malvertising marketing campaign designed to facilitate advert fraud, monitor net searches, set up browser extensions, and sideload APK recordsdata code onto customers’ units.
Essentially the most uncommon side of the marketing campaign is that the evil twin masquerades because the decoy twin by spoofing the latter’s app ID and promoting writer IDs for rendering advertisements. Each the decoy and evil twin units of apps function on the identical infrastructure, permitting the risk actors to exponentially scale their operations as required.
That having mentioned, not solely do the decoy apps behave usually, a majority of them don’t even render advertisements. In addition they incorporate a GDPR consent discover.
“This ‘decoy/evil twin’ mechanism for obfuscation is a novel approach for risk actors to characterize fraudulent visitors as reliable,” HUMAN researchers mentioned. “At its peak, Konfety-related programmatic quantity reached 10 billion requests per day.”
Put otherwise, Konfety takes benefit of the SDK’s advert rendering capabilities to commit advert fraud by making it much more difficult to differentiate malicious visitors from reliable visitors.
The Konfety evil twin apps are mentioned to be propagated through a malvertising marketing campaign selling APK mods and different software program like Letasoft Sound Booster, with the booby-trapped URLs hosted on attacker-controlled domains, compromised WordPress websites, and different platforms that permit content material uploads, together with Docker Hub, Fb, Google Websites, and OpenSea.
Customers who find yourself clicking on these URLs are redirected to a site that methods them into downloading the malicious evil twin app, which, in flip, acts as a dropper for a first-stage that is decrypted from the belongings of the APK file and is used to arrange command-and-control (C2) communications.
The preliminary stager additional makes an attempt to cover the app’s icon from the gadget’s residence display screen and runs a second-stage DEX payload that performs fraud by serving out-of-context, full-screen video advertisements when the person is both on their residence display screen or utilizing one other app.
“The crux of the Konfety operation lies within the evil twin apps,” the researchers mentioned. “These apps mimic their corresponding decoy twin apps by copying their app ID/bundle names and writer IDs from the decoy twin apps.”
“The community visitors derived from the evil twin purposes is functionally similar to community visitors derived from the decoy twin purposes; the advert impressions rendered by the evil twins use the bundle identify of the decoy twins within the request.”
Different capabilities of the malware embrace weaponizing the CaramelAds SDK to go to web sites utilizing the default net browser, luring customers by sending notifications that immediate them into clicking on the bogus hyperlinks, or sideloading modified variations of different promoting SDKs.
That is not all. Customers putting in the Evil Twins apps are urged so as to add a search toolbar widget to the gadget residence display screen, which surreptitiously displays their searches by sending the information to domains named vptrackme[.]com and youaresearching[.]com.
“Menace actors perceive that internet hosting malicious apps on shops isn’t a steady method, and are discovering inventive and intelligent methods to evade detection and commit sustainable long run fraud,” the researchers concluded. “Actors establishing mediation SDK corporations and spreading the SDK to abuse high-quality publishers is a rising method.”
