Quick Summary
At NDSS 2025, researchers presented findings on malware promotion through app ads, revealing that the risk of encountering malware via these ads is significantly higher than through Google Play. Their study evaluated 18,627 app promotion ads, uncovering that popular ad networks like Google AdMob, Unity Ads, and Applovin are exploited by malicious developers. The research introduced a new detection method, ADGPE, which improved malware detection accuracy and identified previously benign apps as potentially harmful.
The Securityish Brief
The NDSS 2025 conference showcased research by a team from various universities, including the University of Notre Dame and Case Western Reserve University, focusing on malware distribution through app promotion ads. Their study revealed that inadequate vetting of ad content allows malicious developers to leverage app promotion ads as a distribution channel for malware. The evaluation covered 18,627 app promotion ads, demonstrating that the likelihood of encountering malware from these ads is hundreds of times greater than from the Google Play Store.
The researchers developed a novel approach called ADGPE, which integrates app user interface exploration with graph learning. This method not only collects app promotion ads but also detects malware promoted through these ads and explains the promotion mechanisms used. Their findings indicated that popular ad networks such as Google AdMob, Unity Ads, and Applovin are being exploited to disseminate various types of malware, including aggressive adware and trojans.
ADGPE’s effectiveness was highlighted by its ability to find 24% more app promotion ads compared to existing techniques. The malware detection model achieved a significant improvement in F1 score, rising from 90.14% to 95.31%. This model also flagged 28 apps that were initially deemed benign by VirusTotal but later identified as malware or potentially unwanted apps.
Understanding Malware Promotion Mechanisms
The research uncovered two primary malware promotion mechanisms: custom-made ad-based promotion, which utilizes hardcoded ads, and ad library-based promotion, which interacts with ad servers like AdMob and Applovin. These insights emphasize the critical security risks associated with app promotion ads and the need for enhanced detection methods.
As malware continues to evolve, the implications for everyday users and organizations are significant. Users must be cautious when downloading apps promoted through ads, as these may lead to malware infections. Organizations should consider implementing stricter vetting processes for ad content and educating users about the risks associated with app promotion ads.
Key Takeaways
- Be cautious when downloading apps promoted through ads, as they may lead to malware infections.
- Regularly check app permissions and reviews to identify potentially harmful apps.
- Educate users about the risks of malware from app promotion ads.
- Implement stricter vetting processes for ad content in your organization.
- Monitor app behavior for unusual activity that may indicate malware presence.
Key Terms & Concepts
- ADGPE: In this article, ADGPE refers to a novel approach for detecting malware in app promotion ads through user interface exploration and graph learning.
- F1 score: F1 score is a measure of a model’s accuracy that considers both precision and recall, used to evaluate the performance of the malware detection model.
- app promotion ads: App promotion ads are advertisements designed to promote other applications, which can be exploited to distribute malware.
- malware: Malware refers to malicious software designed to harm, exploit, or otherwise compromise the functionality of devices or networks.
Read the original article here: https://securityboulevard.com/2026/02/ndss-2025-detecting-and-explaining-malware-promotion-via-app-promotion-graph/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
