240+ Android apps caught showing out-of-context ads

The malicious applications were showing ads but making them appear as coming from other, legitimate apps.

Android adware

Google has removed this summer more than 240 Android applications from the official Play Store for showing out-of-context ads and breaking a newly introduced Google policy against this type of intrusive advertising.

Out-of-context ads (also known as out-of-app ads) are mobile ads that are shown outside an app's normal container. They can appear as popups or as fullscreen ads.

Out-of-context ads are banned on the Play Store since February this year, when Google banned more than 600 apps that were abusing this practice to spam their users with annoying ads.

But despite the public crackdown and ban, other apps showing out-of-context ads have continued to be discovered — such as in June this year.

New cluster discovered

The latest of these discoveries come from ad fraud detection firm White Ops. In a blog post today, the company said it discovered a new cluster of more than 240+ Android apps bombarding their users with out-of-context ads — but made to look like they originated from other, more legitimate applications.

rainbowmix.png

One of RainbowMix's out-of-context ads made to look like it originated from the YouTube app.

Image: White Ops

White Ops named this group RainbowMix and said it detected the first signs of activity as early as April this year.

Most of the apps were gaming-related, were clones of legitimate apps, but also included a malicious component known as "com.timuz.a" that was responsible for showing the misleading, out-of-context ads.

White Ops said the 240+ apps managed to amass more than 14 million downloads this year alone, and the entire operation reached its peak in August when it was delivering more than 15 million ad impressions per day.

rainbowmix-chart.png

Image: White Ops

According to White Ops telemetry, most of the apps were installed by users across the Americas and Asia, with the top countries being:

  • 20.8% - Brazil
  • 19.7% - Indonesia
  • 11.0% - Vietnam
  • 7.7% - US
  • 6.2% - Mexico
  • 5.9% - Philippines

The names of all the 240+ apps part of the RainboxMix campaign are listed in the appendix of this White Ops blog post.

Also, this week, White Ops announced a future name change to a new name that's more inclusive and representative for all its diverse cast.