.jpg&h=570&w=855&q=100&v=20250320&c=1)
Cybersecurity experts McAfee's Mobile Research team has uncovered a concerning practise, whereby apps distributed through Google Play are covertly loading ads while the user’s device screen is turned off.
In an advisory released last Friday, the organisation revealed that whilst this may be a convenient way for developers to make money without subjecting consumers to invasive adverts, the action in fact, is a violation of Google Play's developer standards which specify how advertisements should be shown.
"This affects not only the advertisers who pay for invisible ads, but also the users as it drains battery, consumes data and poses potential risks such as information leaks and disruption of user profiling caused by clicker behaviour," said McAfee.
The research uncovered 43 rogue apps that collectively received 2.5 million downloads, with the well-known TV/DMB player, music downloader, news, and calendar apps being amongst the most affected categories.
The apps in question used an advanced ad fraud library that deploys delay techniques to avoid detection and inspection. The fraudulent behaviour can also be remotely changed and pushed using the Firebase Storage or messaging services, which makes it more difficult to identify the malicious activity.
Once installed, the adware requests certain rights like "Power Saving Exclusion" and "Draw Over Other Apps," enabling covert background operations, according to McAfee. This lets in more malicious activity, such as showing phishing pages and ads without the user's knowledge.
When the device screen is off, the ad fraud starts retrieving and loading ads while the users are still unaware. In order to receive advertisement URLs from Firebase Storage, the library registers device information and requests particular domains, taxing the battery and using up mobile data.
McAfee have reported their findings to Google, resulting in a number of the apps being updated to conform with their regulations, and others deleted from the Play Store entirely.
McAfee has said it is essential for users to exercise caution and carefully evaluate the necessity of granting permissions such as the power saving exclusion before allowing them. While these might be required for certain legitimate functionalities for running in the background, it is important to consider the potential risks linked with them, such as enabling hidden behaviours or reducing the relevance of ads and contents displayed to users because of the hidden clicker behaviour.
.jpg&h=334&w=500&q=100&v=20250320&c=1)
+(900+x+600+px)+(3).png&h=334&w=500&q=100&v=20250320&c=1)
.jpg&h=334&w=500&q=100&v=20250320&c=1)
.jpg&h=268&w=401&q=100&v=20250320&c=1)
.jpg&h=268&w=401&q=100&v=20250320&c=1)
.jpg&h=268&w=401&q=100&v=20250320&c=1)
.png&h=268&w=401&q=100&v=20250320&c=1)
.jpg&h=268&w=401&q=100&v=20250320&c=1)
.png&h=268&w=401&q=100&v=20250320&c=1)
