New Android Trojan uses AI to click on ads without the user's knowledge - Межа
A new family of click fraud malware has appeared on Android, using TensorFlow machine learning models to automatically detect and interact with advertising elements, Bleeping Computer reports , citing a Dr.Web report.
Unlike classic Trojans, the new malware uses machine learning-based visual analysis and does not involve script-based DOM-level interaction. Using the open-source TensorFlow.js library, attackers can run AI models in browsers or on servers using Node.js.
There are currently two modes of operation. The first, Phantom, uses a hidden WebView to load the page, take a screenshot of it, which is then analyzed by an AI model, and then click on the advertising elements. The second mode, Signaling, broadcasts the screen in real time via WebRTC to attackers, who can then interact with the advertising themselves.
Researchers note that such malware currently does not pose a direct threat to users' privacy or personal data, but it can harm the device by draining the battery, leading to its premature degradation, as well as increasing mobile data usage.
Attackers are distributing a new Trojan through games available on the GetApps store on Xiaomi devices. The malware was spotted in games such as Theft Auto Mafia with 61,000 downloads, Cute Pet House – 34,000, Creation Magic World – 32,000, Amazing Unicorn Party – 13,000, Open World Gangster – 11,000, and Sakura Dream Academy – 4,000.
It is currently being distributed via third-party APK sites, such as Apkmody and Moddroid, which offer modified versions of Spotify, YouTube, Netflix, and other services infected with malware. The same apps are also being distributed via Telegram and Discord channels.
To avoid falling victim to the new Trojan, Android users are advised to download apps only from official sources, especially Google Play. They are also advised to avoid "alternative" versions of popular apps, such as the aforementioned Spotify or YouTube, which offer free access to premium features.
Read also: New virus has appeared on Android that intercepts messages from messengers and steals banking data
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
