Hunting for DNS Traces of Hundreds of Malicious Google Play Apps

Bitdefender uncovered a large-scale ad fraud campaign involving hundreds of malicious apps available for download in Google Play.¹ According to the researchers, the apps have been downloaded more than 60 million times. When installed, they displayed out-of-context ads and persuaded victims to give away their credentials and credit card information via phishing.

The security researchers identified 428 URLs as indicators of compromise (IoCs) that we extracted 197 unique domains from. Our expansion analysis of the 197 domains tagged as IoCs led to the discovery of:

• 145 email-connected domains, two of which were malicious
• 109 IP addresses
• 11 IP-connected domains
• 359 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.bitdefender.com/en-us/blog/labs/malicious-google-play-apps-bypassed-android-security