NewApp Digest
search bot

ad fraud

Malware Found Pre-Installed In Thousands Of Budget Android Phones - Here's What We Know
AppWizard
October 16, 2026

Malware Found Pre-Installed In Thousands Of Budget Android Phones – Here’s What We Know

A report from Bitdefender reveals a malware campaign named "Midnight Mimosa" affecting budget and midrange Android smartphones, particularly those using low-energy MediaTek chipsets. This malware, embedded in devices marketed under various labels like Cubot and Doogee, operates through an application called "System" (package name com.android.system.lite) that displays hidden ads and can allow hackers to control the devices. Thousands of devices have been tracked with this malware, with 13% of affected devices located in Mexico, 8% in the United States, and less than 3% in Canada. The malware's source traces back to Android ODM Shenzhen Zediel. Additionally, Bitdefender identified 13 other ad fraud-related apps signed by the same entity that were previously available on the Google Play Store. Major manufacturers like Google, Motorola, and Samsung have security protocols to protect their firmware, unlike the affected budget brands.
Your Android phone could be infected before you turn it on
AppWizard
October 9, 2026

Your Android phone could be infected before you turn it on

Bitdefender researchers have identified a malware campaign called Midnight Mimosa that can be embedded in the software of low-cost Android devices before sale. This malware operates stealthily, allowing it to install and remove applications without user knowledge, generate fraudulent advertising activity, and convert devices into residential-proxy relay nodes for a botnet. It has been found on MediaTek-based, white-label devices marketed under misleading names. Users should be cautious of suspiciously cheap devices and look for signs of infection, such as unexplained ads, unfamiliar apps, sudden battery drain, and discrepancies in model names. Standard uninstallation or factory resets may not remove this malware, and users are advised to update their devices, review app lists, and contact sellers for refunds or replacements if they suspect infection. Mobile protection solutions can help monitor app behavior and alert users to potential threats.
New Android Malware Spotted Infecting Cars Via Software Updates
AppWizard
August 21, 2026

New Android Malware Spotted Infecting Cars Via Software Updates

A new strain of Android malware has emerged, targeting automotive head units responsible for infotainment, connectivity, and navigation in vehicles. Discovered by Kaspersky in June, this is the first documented instance of malware affecting car head units, specifically within the firmware updaters of Android-based software developed by DoFun, a Hong Kong company. The malware, disguised as an application called JarService, infiltrates devices without user awareness. It is delivered through a legitimate system application called TWCore, which collects analytics and updates software. The malware aims to convert the head unit into a botnet, equipped with commands to download and execute code and display advertisements, potentially for online ad fraud. Kaspersky notified DoFun, which addressed the vulnerabilities, and noted similarities between this malware and a previous threat called BadBox, which affected various Android devices.
How to Stop Scammers From Showing You Ads on Your Android After Every Phone Call
AppWizard
July 29, 2026

How to Stop Scammers From Showing You Ads on Your Android After Every Phone Call

Android users experiencing unexpected ads after phone calls are encountering a form of ad fraud linked to applications on the Google Play Store that utilize a tactic called AfterCall. These applications, often benign utility apps, request overlay permissions to display ads over the Android interface. They can launch full-screen advertisements disguised as call information screens after detecting the end of a call. Overlay permissions are categorized as "special permissions" and require users to enable them in system settings, rather than through typical installation pop-ups. Users are advised to check for apps with overlay permissions by navigating to Settings > Apps > Special app access and uninstall any unfamiliar applications. Regular audits of these permissions are recommended to disable unnecessary ones. While these apps primarily serve as an annoyance, they can waste advertising dollars and potentially harm brand reputations.
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
AppWizard
July 23, 2026

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

GitHub will reject command-line support bundle uploads from outdated versions of GitHub Enterprise Server lacking security patches starting August 18, 2026. The npm package @copilot-mcp/apex has been identified as a post-install dropper that installs a macOS infostealer, phishing for sensitive information and maintaining a connection to an attacker's server. A rogue extension on the Microsoft Visual Studio Code marketplace, "Markdown All Pro," impersonates a legitimate tool and opens a backdoor after installation. A phishing campaign targeting Portuguese users delivers the Lampion banking malware, which has been active since 2019. DoubleVerify reports a rise in "AfterCall" apps that exploit user permissions for ad fraud. The GhostCommit attack method hides malicious instructions within PNG images in pull requests. The U.S. government has updated its advisory on Iranian-affiliated cyber activity targeting operational technology devices. An Android app posing as a civil defense alert system has been found to contain malware for data harvesting. An Iranian threat actor is distributing MarkiRAT malware through fake applications. An analysis of 28 AI-coded applications revealed 434 vulnerabilities, prompting Cisco to introduce Antares to identify vulnerabilities in codebases. A Russian-speaking threat actor is dismantling guardrails on AI models to create offensive tools.
‘No Future Updates’—Google Will Confirm Play Store App Deletion
AppWizard
May 27, 2026

‘No Future Updates’—Google Will Confirm Play Store App Deletion

Google is enhancing the security of its Play Store by removing high-risk and low-quality applications and will soon notify users when an app has been deleted from the Play Store. This notification will inform users that the app will no longer receive updates, which is crucial for security as unpatched apps can be exploited. Currently, users only receive alerts about significant security threats, but the new feature aims to improve user awareness regarding app removals. The change comes amid rising cyber threats, with a recent report indicating that vulnerability exploitation is a major risk. Previously, users were not notified about app removals, leaving them unaware unless they found out through other means.
Google May Add Play Store Alerts For Removed Android Apps
AppWizard
May 27, 2026

Google May Add Play Store Alerts For Removed Android Apps

Google has implemented a new feature in its Play Store that notifies users when an app has been removed from the marketplace. This update informs users that the app will no longer receive updates, including security fixes, which could leave them vulnerable. The notification will detail each deleted app and its removal from Google Play. There is uncertainty about whether the update will allow users to delete these apps directly. This initiative responds to a shift in the threat landscape, where exploiting vulnerabilities has become the primary method of breaching devices, surpassing stolen credentials. Recent reports highlighted the necessity for user notifications, citing a new ad fraud campaign involving 453 apps that were installed 24 million times before removal. Previously, users had no formal notification system for app removals.
InPVP acquires Feather Client, rebrands as Dawn
AppWizard
May 22, 2026

InPVP acquires Feather Client, rebrands as Dawn

InPVP has acquired Feather Client, a third-party Minecraft launcher, focusing on its in-game technology rather than the launcher itself. The acquisition was announced by InPVP owner Mohamed “PizzaMC” Weheba at the UGCon conference in Las Vegas. Feather Client’s parent company, Silentstack, will launch a new launcher called Dawn. Weheba clarified that the acquisition involves a sale of assets without taking on previous liabilities. The acquisition follows allegations of ad fraud against Feather Client. Weheba plans to reduce reliance on ad monetization and focus on direct-to-consumer revenue streams, including the sale of cosmetics and in-game items. He aims to enhance user experience with features like a profanity filter for voice chat and plans to collaborate with the competitive Minecraft organization MCPVP for tournaments. Aditude, Feather's former ad tech provider, has resumed its partnership with Dawn, expressing confidence in Weheba's leadership and the new direction of the project.
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps
AppWizard
May 20, 2026

Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Cybersecurity researchers have identified an ad fraud and malvertising operation called Trapdoor, targeting Android users with 455 malicious applications and 183 command-and-control domains. Users often download these disguised apps, which initiate malvertising campaigns and lead to further downloads of malicious applications. At its peak, Trapdoor generated 659 million bid requests daily, with over 24 million downloads of the associated apps, primarily from the United States. The operation exploits install attribution tools to activate malicious activities only for users acquired through fraudulent ad campaigns, while suppressing such behavior for organic downloads. Trapdoor employs advanced evasion techniques, including obfuscation and impersonation of legitimate software, to avoid detection. Google has removed the identified malicious apps from the Play Store in response to the threat.
Search