Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Malware

GhostAd

GhostAd is an Android adware campaign identified by Check Point that used at least 15 related applications distributed through Google Play, where they masqueraded as utility and emoji-editing tools. The apps established a persistent background advertising engine that continued operating after the user closed the app or rebooted the device. To maintain execution, they abused Android foreground services and displayed blank, unremovable notifications, while also using JobScheduler loops to repeatedly restart ad-loading activity every few seconds if interrupted. The malware continuously loaded, queued, and refreshed ads in the background through legitimate ad SDKs including Pangle, Vungle, MBridge, AppLovin, and BIGO, generating ad impressions and revenue while draining battery, consuming data, and degrading device performance. Reported user-visible effects included persistent pop-up ads, slowed device responsiveness, and app icons disappearing during uninstall attempts. The campaign primarily affected users in East and Southeast Asia, especially the Philippines, Pakistan, and Malaysia, and reached millions of downloads, with one app reportedly ranking #2 in Google Play's Top Free Tools category. Check Point reported that Google removed the identified apps from Google Play and that Google Play Protect disables them on affected devices. The reporting also warns that apps with this level of background persistence and external storage access could scan shared storage and exfiltrate corporate files to remote servers. High-confidence IOC hashes associated with the campaign include 7185a439005033b45b48294b302973898e68d8c898003f98acc275b27948ad40, a039c862807a14482169db0db5904749b7e5d733807418430d1cc3c2e3724f96, ebd4365923964218caa24c9f88f009aefa7f1427a20f0f02927c98285734dae5, 13805e77fb44a5a5af829f13ee494b9cfc4d5c9b470d51014cd506bd40c57426, and 91eb6afb903b2155246cb64289b4c2554922e0472fb355091843e0138c91a114.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique
T1583.001DomainsEvidence1

"identified a network of Android applications on Google Play masquerading as harmless utility and emoji-editing tools"

Execution

1 technique
T1053Scheduled Task/JobEvidence1

"the apps use a JobScheduler that re-triggers ad-loading tasks every few seconds... the scheduler restarts it almost immediately"

Persistence

3 techniques
T1053Scheduled Task/JobEvidence1

"the apps use a JobScheduler that re-triggers ad-loading tasks every few seconds... the scheduler restarts it almost immediately"

T1543Create or Modify System ProcessEvidence1

"GhostAd apps register a foreground service that ensures continuous execution"

T1547Boot or Logon Autostart ExecutionEvidence1

"kept running even after users closed or rebooted their devices"

Privilege Escalation

3 techniques
T1053Scheduled Task/JobEvidence1

"the apps use a JobScheduler that re-triggers ad-loading tasks every few seconds... the scheduler restarts it almost immediately"

T1543Create or Modify System ProcessEvidence1

"GhostAd apps register a foreground service that ensures continuous execution"

T1547Boot or Logon Autostart ExecutionEvidence1

"kept running even after users closed or rebooted their devices"

Stealth

2 techniques
T1036MasqueradingEvidence1

"masquerading as harmless utility and emoji-editing tools. Behind their cheerful icons..."

T1564Hide ArtifactsEvidence1

"presenting a blank, constant notification... effectively invisible" and "vanishing app icons when attempting to uninstall"

Command and Control

1 technique
T1071Application Layer ProtocolEvidence1

"establish and maintain a long-lived connection back to an attacker-controlled backend"

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

"scan shared folders... and exfiltrate them to a remote server without the user noticing"

Impact

1 technique
T1496Resource HijackingEvidence1

"continuously load, queue, and refresh ads in the background... quietly consuming battery and mobile data"

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app7 months ago
hash.sha256●●●●●●●●●●●●View more in app7 months ago
hash.sha256●●●●●●●●●●●●View more in app7 months ago
hash.sha256●●●●●●●●●●●●View more in app7 months ago
hash.sha256●●●●●●●●●●●●View more in app7 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.