Loading story…
Researchers reported that Trojan-Dropper.AndroidOS.Shopper.a used Android's AccessibilityService to take over device interactions, silently grant permissions, disable Google Play Protect, and install applications from Google Play or APKPure. Disguised as a system app named ConfigAPKs, the malware collected device details, waited until the screen was unlocked to fetch additional payloads, and contacted the command-and-control domain api.adsnative123[.]com.
The malware was used to manipulate app-store rankings by inflating installs, registrations, and fraudulent reviews while also displaying ads and creating shortcuts to advertising sites. Infected devices were further abused to register accounts in legitimate apps using victims' Google or Facebook credentials, with activity reported most heavily in Russia during late 2019, followed by Brazil and India.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Trojan-Dropper.AndroidOS.Shopper.a was reported as most prevalent during October to November 2019, with the largest share of infected users in Russia, followed by Brazil and India. The malware was used to manipulate app-store rankings, inflate installs and registrations, and post fraudulent reviews.
Securelist published technical details on Trojan-Dropper.AndroidOS.Shopper.a, describing its abuse of Android AccessibilityService to grant permissions, disable Google Play Protect, install apps, and automate fraudulent actions. The report also identified command-and-control infrastructure including api.adsnative123[.]com and provided MD5 indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several Android malware families, including **Joker**, **MobOk**, **Vesub**, and **GriftHorse**, were found fraudulently enrolling victims in paid mobile subscription services by abusing device permissions, intercepting SMS confirmation codes, and hiding billing steps inside deceptive app workflows. Researchers said the malware used techniques such as notification access, invisible webviews, fake login prompts, and anti-fraud evasion to complete sign-ups without clear user consent, turning infected phones into tools for recurring premium-service charges. The campaigns were distributed through multiple channels, including **Google Play**, unofficial app stores, preinstalled software, and trojanized popular applications. **Joker** operated as a staged downloader that could tamper with confirmation flows, **MobOk** added CAPTCHA bypass capabilities and was often linked to delivery by **Triada**, **Vesub** spread through fake apps from unofficial sources, and **GriftHorse** variants relied on misleading subscription pages and hidden recurring billing terms. Victim telemetry covering January 2021 through March 2022 showed **Russia** as the most affected country overall, with **MobOk** identified as the most prevalent family among the subscription trojans reviewed.
Aug 14, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026