Researchers Detail 331 Malicious Google Play Apps That Bypassed Android 13 Protections
Summary
Bitdefender researchers analyzed a campaign of at least 331 Google Play apps with more than 60 million downloads. The apps bypassed Android restrictions to hide, launch ads, and direct users to phishing attempts; 15 were still available when the research ended.
Key points
- At least 331 apps were involved, with more than 60 million downloads; 15 were still on Google Play when the researchers finished their investigation.
- The apps posed as utilities and, in some cases, originally benign apps gained malicious behavior in later updates.
- Attackers used content providers and native code to launch apps without user interaction and to hide or toggle their launcher icons.
- The apps used virtual displays and Android's presentation API to start fullscreen activities without the usual overlay permission, showing intrusive ads and phishing pages.
- Phishing screens sought credentials for online services and credit card information.
- The apps used foreground services and dummy receivers or services for persistence, and communicated with custom C2 domains using encrypted and polymorphed data.
- Researchers found string and native-library obfuscation, as well as checks for emulators and debuggers; the campaign was still active in March 2025.
Article Details
- Attack Vectors
- Malicious apps distributed through the Google Play Store displayed out-of-context full-screen ads over other applications.
- Some apps presented phishing screens seeking online-service credentials and credit-card information.
- Apps used a content provider queried after installation to start without user interaction.
- Apps hid or dynamically enabled and disabled launcher icons, including by using native code and the LEANBACK_LAUNCHER mechanism.
- Apps used virtual displays and Android presentation APIs to launch activities while not in the foreground, without the SYSTEM_ALERT_WINDOW permission.
- Most investigated apps used content providers, foreground services, dummy broadcast receivers, or services as persistence mechanisms.
- Most apps communicated with dedicated C2 domains using package-specific links and encrypted communication involving AES, Base64, and custom encryption.
- Apps exfiltrated device information in a dictionary-based structure with polymorphed keys.
- Most analyzed apps used XOR-based string obfuscation; native libraries had randomly generated names and runtime checks for emulators or attached debuggers.
- Defensive Notes
- Do not rely solely on default Android-device or Google Play Store protections; the article describes Bitdefender Mobile Security's App Anomaly Detection as observing app behavior after installation.
- Review installed apps for unexpected full-screen ads, hidden launcher icons, altered app names, or screens requesting credentials or payment information.
MITRE ATT&CK
People
Adina Lenuta Maria COLF (MATEESCU)Named author and member of Bitdefender's Android research team.Albert ENDRE-LASZLONamed author and Bitdefender junior security researcher.Alecsandru Cătălin DAJNamed author and Bitdefender security researcher associated with the investigation.Alex BACIUNamed author and Bitdefender junior security researcher.Elena FLONDORNamed author; the article describes her as working on malware.
Vendors
BitdefenderBitdefender's security researchers have identified a large-scale ad fraud campaign that deployed hundreds of malicious apps in the Google Play Store, resulting in more than 60 million downloads total. The apps displayGoogleHundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease
Products
AndroidHundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With EaseApp Anomaly DetectionThe technology embedded in Bitdefender Mobile Security, App Anomaly Detection, observes the apps’ behavior after installation, which is critical in today’s threat landscape. In some cases, bad actors alter theBitdefender Mobile SecurityThe technology embedded in Bitdefender Mobile Security, App Anomaly Detection, observes the apps’ behavior after installation, which is critical in today’s threat landscape. In some cases, bad actors alter theGoogle Play Storehave identified a large-scale ad fraud campaign that deployed hundreds of malicious apps in the Google Play Store, resulting in more than 60 million downloads total. The apps display out-of-context ads and even tryGoogle VoiceWe also noticed that some apps try to hide even in Settings to avoid user removal. In the example below and the video, the app even changes its name to Google Voice to look like an official one.