Google removes apps that promised users freebies but ran fraud ads

Users were lured with offers of free shoes, tickets, coupons on downloading apps and letting them stay on their phones for at least two weeks.

Terracotta apps on Google Play Store.

There's been a series of Android apps that have been removed from the Google Play Store for malicious activities. The latest is a batch of Android apps that promised users free shoes, sneakers, and even tickets to users but instead installed botnet on their phones.

This botnet was discovered by the White Ops' Satori mobile security team. It's called “Terracotta” and the Satori team had been researching it since late 2019. These apps act in one particular way by luring users with free perks if they download the apps. Users were offered things like free shoes, tickets, coupons, sneakers, boots and even expensive dental treatments. After installing these apps, users were asked to wait for two weeks to get the freebies.

During this time period of two weeks, what the apps actually did was run a modified version of WebView which is a toned-down version of Chrome. This was then used to launch ads and gain revenue from these fake ad impressions. Users are unaware of this process that's happening without their knowledge. Although running a fake ad network, Terracotta could still avoid detection from defrauded ad networks, the Satori team said.

While it doesn't have a direct impact on users, Terracotta apps are still harmful as it often leads to heavy consumption of batteries and mobile data as well. The network that the Terracotta apps run is massive and over 2 billion ads were loaded from 65,000 phones during the final week of June alone. White Ops informed Google and most of these apps have been removed from the Play Store. There are still a few lurking around.

For such findings, the list of malicious apps is usually revealed but in this case it's not. The best thing to do right now is to be aware of such apps and double-check before installing them on your phone.