The malicious applications were showing ads but making them appear as coming from other, legitimate apps.
Google has removed this summer more than 240 Android applications from the official Play Store for showing out-of-context ads and breaking a newly introduced Google policy against this type of intrusive advertising.
Out-of-context ads (also known as out-of-app ads) are mobile ads that are shown outside an app's normal container. They can appear as popups or as fullscreen ads.
Out-of-context ads are banned on the Play Store since February this year, when Google banned more than 600 apps that were abusing this practice to spam their users with annoying ads.
But despite the public crackdown and ban, other apps showing out-of-context ads have continued to be discovered — such as in June this year.
NEW CLUSTER DISCOVEREDThe latest of these discoveries come from ad fraud detection firm White Ops. In a blog post today, the company said it discovered a new cluster of more than 240+ Android apps bombarding their users with out-of-context ads — but made to look like they originated from other, more legitimate applications.
One of RainbowMix's out-of-context ads made to look like it originated from the YouTube app.
Image: White Ops
White Ops named this group RainbowMix and said it detected the first signs of activity as early as April this year.
Most of the apps were gaming-related, were clones of legitimate apps, but also included a malicious component known as "com.timuz.a" that was responsible for showing the misleading, out-of-context ads.
White Ops said the 240+ apps managed to amass more than 14 million downloads this year alone, and the entire operation reached its peak in August when it was delivering more than 15 million ad impressions per day.
Image: White Ops
According to White Ops telemetry, most of the apps were installed by users across the Americas and Asia, with the top countries being:
- 20.8% - Brazil
- 19.7% - Indonesia
- 11.0% - Vietnam
- 7.7% - US
- 6.2% - Mexico
- 5.9% - Philippines
The names of all the 240+ apps part of the RainboxMix campaign will be listed later today in a blog post on the White Ops blog.
Also, this week, White Ops announced a future name change to a new name that's more inclusive and representative for all its diverse cast.