Several adware apps promoted aggressively on Facebook as system cleaners and optimizers for Android devices are counting millions of installations on Google Play store.
The apps lack all of the promised functionality and push advertisements while trying to last as long as possible on the device.
To evade deletion, the apps hide on the victim's device by constantly changing icons and names, masquerading as Settings or the Play Store itself.
The adware apps abuse the Contact Provider Android component, which enables them to transfer data between the device and online services.
The subsystem is called every time a new app is installed, so the adware might be using it to initiate the ad-serving process. To the user it may look like the ads are pushed by the legitimate app they installed.
Researchers at
McAfee discovered the adware apps. They note that users don't have to launch them after installation to see the ads because the adware initiates itself automatically without any interaction.
The first action from these annoying apps is to create a permanent service for displaying the advertisements. If the process is "killed" (terminated), it re-launches immediately.
