New Malicious Clicker found in apps installed by 20M+ users

October 27, 2022
Post Author / Publisher: McAfee

CISO2CISO post categories: Cyber Security News, McAfee Antivirus | Securing Tomorrow RSS Feed

Rate this post

Authored by SangRyol Ryu

Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares masquerading as a useful tool or utility, and automatically crawling ads in the background. Recently the McAfee Mobile Research Team has identified new Clicker malware that sneaked into Google Play. In total 16 applications that were previously on Google Play have been confirmed to have the malicious payload with an assumed 20 million installations.

McAfee security researchers notified Google and all of the identified apps are no longer available on Google Play. Users are also protected by Google Play Protect, which blocks these apps on Android. McAfee Mobile Security products detect this threat as Android/Clicker and protect you from malware. For more information, to get fully protected, visit McAfee Mobile Security.

How it works

The malicious code was found on useful utility applications like Flashlight (Torch), QR readers, Camara, Unit converters, and Task managers:

Once the application is opened, it downloads its remote configuration by executing an HTTP request. After the configuration is downloaded, it registers the FCM (Firebase Cloud Messaging) listener to receive push messages. At first glance, it seems like well-made android software. However, it is hiding ad fraud features behind, armed with remote configuration and FCM techniques.

Attribute name
Known meaning of the value

FCMDelay
Initial start hours after first installation

adButton
Visivility of a button of Advertisement

adMob
AdMob unit ID

adMobBanner
AdMob unit ID

casOn
Whether CAS library works or not

facebookAd
FaceBook Ad ID

fbAdRatio
Ratio of FB AD

googleAdRatio
Ratio of AdMob

is
Decide BootService to run or not

urlOpen
to open popup or not when starts PowerService

popUrl
URL for PowerService

popUpDelay
Delay time for PowerService

liveUrl
URL for livecheck service

pbeKey
Key for making unique string

playButtonList
URL for other service

reviewPopupDialog
‘y’ it shows review dialog

tickDelay
Delay time for TickService

tickEnable
Value of TickService enabled

tickRandomMax
Value of TickService random delay

tickRandomMin
Value of TickService random delay

tickType
Set the type of TickService

updateNotiVersion
Value for showing update activity

The FCM message has various types of information and that includes which function to call and its parameters. The picture below shows some of FCM message history:

When an FCM message receives and meets some condition, the latent function starts working. Mainly, it is visiting websites which are delivered by FCM message and browsing them successively in the background while mimicking user’s behavior. This may cause heavy network traffic and consume power without user awareness during the time it generates profit for the threat actor behind this malware. In the picture below there is an example of the network traffic generated to get the information required to generate fake clicks and the websites visited without user’s consent or interaction:

Malicious components: CAS and LivePosting

So far, we have identified two pieces of code related to this threat. One is “com.click.cas” library which focuses on the automated clicking functionality while “com.liveposting” library works as an agent and runs hidden adware services:

Depending on the version of the applications, some have both libraries working together while other applications only have “com.liveposting” library. The malware is using installation time, random delay and user presence to avoid the users from noticing these malicious acts. The malicious behavior won’t start if the installation time is within an hour and during the time the user is using the device, probably to stay under the radar and avoid being detected right away:

Conclusion

Clicker malware targets illicit advertising revenue and can disrupt the mobile advertising ecosystem. Malicious behavior is cleverly hidden from detection. Malicious actions such as retrieving crawl URL information via FCM messages start in the background after a certain period of time and are not visible to the user.

McAfee Mobile Security detects and removes malicious applications like this one that may run in the background without user’s knowledge. Also, we recommend having a security software installed and activated so you will be notified of any mobile threats present on your device in a timely manner. Once you remove this and other malicious applications, you can expect an extended battery time and you will notice reduced mobile data usage while ensuring that your sensitive and personal data is protected from this and other types of threats.