Loading malware…
Android.HiddenAds is an Android ad-displaying trojan family. According to the provided Doctor Web reporting, members of this family are commonly distributed as seemingly popular or harmless applications. After installation, they attempt to hide from users by concealing or substituting their icons, which hinders detection and removal, and then display intrusive advertisements, including full-screen video ads. The family has been described as one of the most commonly detected Android malware families for several years and remained among the most widespread Android threats through 2025, although detections declined in multiple later reporting periods. Doctor Web also notes Aegis as a subfamily of Android.HiddenAds. The provided content does not attribute Android.HiddenAds to a specific threat actor, industry targeting set, or distinct infection vector beyond distribution as trojanized Android apps.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Members of the Android.HiddenAds family are often distributed as popular and harmless applications... The trojans were concealed in a number of tools for optimizing the operation of Android devices, and were distributed under the guise of messengers, multimedia, and other software.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android ad-displaying trojan family whose activity decreased during Q2 2026.
Android trojan family used to display intrusive ads, often disguised as benign apps and sometimes hiding its icon from the user.
Android adware trojan family focused on displaying advertisements; activity decreased in Q1 2026.
Adware trojan family that displays intrusive full-screen ads and attempts to evade user removal by hiding/altering launcher icons and concealing presence; includes the Aegis subfamily with auto-run behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.