Quick Summary
A new family of Android click-fraud trojans utilizes TensorFlow machine learning models to detect and interact with hidden advertisements. Discovered by Dr.Web, this malware is distributed through Xiaomi’s GetApps store and third-party APK sites. It operates in a ‘phantom’ mode, using a hidden browser to automate ad interactions, and can also stream real-time video to attackers. This poses risks such as battery drainage and increased mobile data charges for users.
The Securityish Brief
Researchers at Dr.Web identified a new family of Android click-fraud trojans that leverage TensorFlow.js, an open-source library by Google, to automate interactions with advertisements. This malware is primarily distributed through Xiaomi’s GetApps store, where it infects games like Theft Auto Mafia, which has 61,000 downloads, and Cute Pet House, with 34,000 downloads. The malware operates in a ‘phantom’ mode, utilizing a hidden WebView-based browser to load target pages for click-fraud and execute JavaScript to automate actions on ads.
In addition to the Xiaomi-hosted apps, the trojans are also spread via third-party APK sites such as Apkmody and Moddroid, where altered versions of popular apps like Spotify and YouTube are available. Dr.Web found that many apps on Moddroid’s “Editor’s Choice” page are infected. Furthermore, infected APK files are distributed through Telegram channels, including Spotify Pro and Spotify Plus – Official.
The malware’s ‘signalling’ mode allows attackers to stream a live video feed of the virtual browser screen, enabling real-time actions like tapping and scrolling. This method is particularly effective against dynamic ads that frequently change structure. The covert nature of the click fraud means users are unlikely to notice any malicious activity, although they may experience battery drain and increased data charges.
Understanding the Risks
While click-fraud and ad fraud may not directly compromise user privacy, they represent a lucrative avenue for cybercriminals. The hidden operations of this malware can lead to significant financial losses for advertisers and increased operational costs for users. Android users should be particularly cautious about installing apps from outside the Google Play Store, especially those promising extra features or free access to premium content.
As this malware evolves, it highlights the need for users to be vigilant about app sources and the permissions they grant. The combination of legitimate-looking apps and hidden malicious functionality can easily deceive unsuspecting users, leading to potential financial and data risks.
Key Takeaways
- Avoid installing apps from outside the Google Play Store to reduce the risk of malware infections.
- Be cautious of alternative versions of popular apps that claim to offer extra features or free access to premium subscriptions.
- Regularly monitor your device’s battery usage and data consumption for unusual activity.
- Keep your Android operating system and apps updated to benefit from the latest security patches.
- Consider using mobile security software to detect and block malicious apps.
Key Terms & Concepts
- Click-fraud trojan: In this article, click-fraud trojans refer to malware that automates clicks on advertisements to generate fraudulent revenue.
- TensorFlow.js: TensorFlow.js is an open-source library developed by Google for training and deploying machine learning models in JavaScript.
- WebRTC: WebRTC is a technology that enables real-time communication between web browsers and mobile applications.
- WebView: WebView is a system component that allows apps to display web content within the app itself.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-android-malware-uses-ai-to-click-on-hidden-browser-ads/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
