HUMAN Security’s Satori Threat Intelligence team has uncovered a sophisticated malware operation dubbed “BADBOX 2.0” that compromised over 50,000 Android devices using 24 deceptive applications. Device owners concerned about infection should verify if their device is Google Play Protect certified, as all infected devices identified were uncertified Android Open Source Project devices manufactured in China and shipped globally. Google Play Protect now automatically warns users and blocks apps exhibiting BADBOX behavior at install time on certified devices with Google Play Services. This operation represents a major expansion of the original BADBOX campaign first identified in 2023, according to researchers who collaborated with Google, Trend Micro, and Shadowserver to partially disrupt the threat. The 24 malicious apps functioned as “evil twins” to legitimate applications in Google Play Store, sharing package names with legitimate “decoy twins” to appear legitimate in ad requests. Devices were infected through a sophisticated backdoor that researchers named “BB2DOOR,” which provided threat actors with persistent privileged access to compromised systems. Researchers at HUMAN Security’s Satori Threat Intelligence team identified four distinct threat actor groups involved in the operation: SalesTracker Group, MoYu Group, Lemon Group, and LongTV. The malware primarily targeted low-cost, “off-brand” Android Open Source Project devices including connected TV boxes, tablets, digital projectors, and vehicle infotainment systems. Users should also ensure Google Play Protect is enabled and avoid downloading apps from unofficial sources. These groups cooperated through shared infrastructure and business connections to deploy multiple fraud schemes including residential proxy services, programmatic ad fraud, and click fraud. This deception allowed the threat actors to generate fraudulent ad traffic at a massive scale, with hidden ads schemes generating up to 5 billion fraudulent bid requests weekly.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 06 Mar 2025 03:45:18 +0000