Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
“Some JavaScript is built into the app and can track where a page has been tapped, then replay that as a synthetic touch, click, or scroll. The rest is sent down from the operator’s own servers at runtime, letting them change what the hidden browser does on any page without pushing an app update.”
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A mobile ad fraud operation embedded in novel-reading Android apps that opens hidden WebViews in the background to load monetized sites, generate clicks, simulate scrolling, and fabricate engagement signals while the visible app appears normal.
Mobile ad fraud operation embedded in novel-reading apps that generates hidden browser traffic, loads websites in concealed webviews, automates clicks and scrolling, and uses remote configuration to control timing, targeting, URLs, and interaction logic for fraudulent monetization.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.