However, with hundreds of new apps uploaded onto the Google Play Store daily, it’s difficult to track whether each app is safe. But there is some good news – these infected apps have been removed from Google Play. The researchers also found that hackers cloned popular applications to attract a large audience, particularly children. As a result, it was available and downloadable for unwitting Google Play users. Tekya obscures native code to slip underneath Google Play Protect’s radar and utilizes a mechanism called MotionEvent (introduced in 2019) to emulate user clicks and generate ad income. Nearly half of the discovered Tekya-infected apps were children’s games, ranging from puzzles to racing games, to attract kids who may haphazardly download the fraudulent apps. Using Tekya, hackers are hoping to fraudulently drive up their CPC rates and attract ad revenue from platforms such as Google’s AdMob, AppLovin, Facebook and Unity. It imitates the user to generate clicks, thus getting paid by the ad agencies for user interactions with ads that the user didn’t do,” Hazum told Laptop Mag. “In Tekya’s case, the exploitation lies in the CPC (Cost-Per-Click) actions.

For example, if an advertiser agrees to a $1.50 CPC rate, he or she will pay $1.50 every time a potential customer clicks their ad and visits their site.

Some advertisers pay for cost-per-click (CPC) advertising to have their ads splashed on an app. Millions of Android phones and tablets vulnerable to attack: What to doPopular password managers can get hacked: Should you keep using them?Microsoft says 99.9% of accounts get hacked for this reason: How to protect yourself

The goal of Tekya, Hazum told Laptop Mag, is to commit mobile-ad fraud. The study – spearheaded by Israel Wernik, Danil Golubenko , Aviran Hazum – found that the Google Play Store-based apps were poisoned with Tekya, which is a form of adware.

Google chrome app store android