Loading story…
Check Point researchers identified an Android malware campaign, dubbed AdultSwine, embedded in roughly 60 game applications on Google Play, many of them designed for children. The infected apps were downloaded an estimated 3 million to 7 million times and used a command-and-control infrastructure to upload device information, receive configuration updates, hide app icons, and trigger advertising behavior after device boot or screen unlock. The malware displayed intrusive ads outside the host app, including pornographic content, while deliberately avoiding overlays on browsers and social networking apps to reduce user suspicion.
The campaign monetized infections through multiple fraud schemes, including fake virus alerts that pushed users toward dubious “security” apps and bogus prize offers such as an iPhone giveaway that harvested phone numbers for premium-service subscription fraud. Researchers warned that the same remotely controlled delivery mechanism could be adapted for broader social-engineering attacks or credential theft, highlighting the risk posed by malicious apps that bypass platform trust and reach large numbers of mobile users through official app stores.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
On its publication date, Check Point researchers disclosed a malicious Android campaign they dubbed AdultSwine, embedded in about 60 Google Play game applications, several aimed at children. The report said the apps had been downloaded an estimated 3 million to 7 million times and monetized infections through pornographic ads, scareware, and fraudulent premium-service subscriptions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026
Researchers at Zimperium’s zLabs uncovered a large Android malware campaign that used nearly 250 malicious apps to silently subscribe victims to premium carrier-billing services and abuse premium SMS flows without consent. The apps impersonated well-known brands and games including **Facebook Messenger**, **Instagram Threads**, **TikTok**, **Minecraft**, and **Grand Theft Auto**, and targeted users in **Malaysia, Thailand, Romania, and Croatia**. The operation was active from March 2025 through January 2026, with some attacker infrastructure still online at the time of reporting. zLabs identified three malware variants that activated only when a device’s SIM matched specific mobile operators, helping the fraud remain hidden from non-targeted users by showing benign fallback pages. The malware used hidden WebViews and JavaScript to automate subscription pages, intercepted one-time passwords through Google’s SMS Retriever API, disabled Wi‑Fi to force cellular billing, stole cookies, sent delayed premium SMS messages, and reported activity through attacker-controlled Telegram channels. Researchers said the infrastructure supported command-and-control, victim tracking, analytics, and exfiltration of device metadata and billing-page content.
Jun 29, 2026
Researchers reported that **Trojan-Dropper.AndroidOS.Shopper.a** used Android's **AccessibilityService** to take over device interactions, silently grant permissions, disable **Google Play Protect**, and install applications from **Google Play** or **APKPure**. Disguised as a system app named **ConfigAPKs**, the malware collected device details, waited until the screen was unlocked to fetch additional payloads, and contacted the command-and-control domain `api.adsnative123[.]com`. The malware was used to manipulate app-store rankings by inflating installs, registrations, and fraudulent reviews while also displaying ads and creating shortcuts to advertising sites. Infected devices were further abused to register accounts in legitimate apps using victims' **Google** or **Facebook** credentials, with activity reported most heavily in **Russia** during late 2019, followed by **Brazil** and **India**.
Aug 15, 2026