Cybersecurity firm Human has discovered and disrupted a mobile ad fraud campaign involving 89 mobile applications with a total download count of 13 million.

Dubbed Scylla, the campaign is the third adaptation of Poseidon, a fraud operation that was initially identified in 2019. Charybdis, the second iteration of the campaign, was observed in 2020.

As part of the new, still ongoing attack, Human has identified a total of 80 Android and 9 iOS applications that engaged in ad fraud through app spoofing, hidden ads, and fake clicks.

The applications contained obfuscated code similar to Charybdis and, just as that attack adaptation, targeted advertising software development kits (SDKs), Human explains.

Some of the Scylla apps contained code to pose as other, completely different applications in front of advertisers and ad tech companies. Human identified 29 Android apps pretending to be over 6,000 CTV-based applications, to bring higher advertising proceeds compared to mobile games.

Other apps contained code that informed advertisers they displayed ads to the user, although that did not happen. The code would render ads when the apps were closed, such as when the device was on the home screen, the researchers say.

Finally, some of the applications would register the information about the user’s real clicks on ads and then send it to advertisers as a fake click.

“These tactics, combined with the obfuscation techniques first observed in the Charybdis operation, demonstrate the increased sophistication of the threat actors behind Scylla,” Human notes.

The security researchers also underline the fact that Scylla is the first iteration of the campaign in which the attackers have expanded their operation to iOS.

Both Google and Apple were informed of the findings and the identified applications were removed from the Google Play Store and Apple App Store. Advertising SDK developers too were notified of the attack.

Human has published a list of Scylla applications and advises users to check that list and consider removing all applications from all devices.

By Ionut Arghire on Tue, 27 Sep 2022 14:25:02 +0000
Original link