[General Topics] sloshnmosh:
I discovered a massive mobile advertising fraud campaign that pushes fake virus warnings that trick novice Android users into installing questionable apps.

The advertiser uses JavaScript hosted on Amazon's CloudFront that uses various techniques to fingerprint the users web browser and if and Android device is discovered a fake media player or fake Captcha will pop up on the users mobile device to try and trick the user into accepting push notifications.

Once the push notifications are pushed to the mobile web browser the phone will start to vibrate and beep or in some cases play loud sirens or even spoken words along with fake virus warnings claiming the device is infected with multiple non-existent viruses that lead the user to the Google Play store to install questionable apps.

Many of the infected websites are geared towards a younger audience such as popular games and anime but also pirated software and movies and porn sites are also infected with this advertisers script.

The advertiser boasts that they are able to bypass adblockers and one of the infected websites "wallpaperaccess(.)com" has also been seen to download a malicious Android app disquised as an AdBlock app.

MD5 sum of AdBlock.apk 6f1fd359a382348b3307ed9d64eeebaa

The advertiser behind the browser fingerprinting script hosted on CloudFront is "AdMaven" out of Tel Aviv.

Near the bottom of the script and hidden using Base64 encoding using a custom alphabet hides the domain names of the websites that do the push notifications from anther company out of Tel Aviv called "moviesupdates(.)com"

In some of the AdMaven scripts I've examined is the name of another advertiser out of Tel Aviv called "Taboola" and their name is also obfuscated in the script using Base64 and the custom alphabet: abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/

Almost all the domains are registred to DynaDot and NameCheap.

*Edited to add that NameCheap has turned over a new leaf and is now actively removing reported content.

Here is just a very small sample of the hundreds of infected websites:

deportivo-la-coruna(.)com/page(.)php

mr2(.)com

acampante(.)com

10lance(.)com

russisk(.)org

www(.)e-jurnal(.)com

formodessa(.)com

hdwallsbox(.)com

brightways(.)org

tvshows4mobile(.)com

freehottip(.)com

www.dlmania(.)com

hdmp4mania1(.)net

streamcr7(.)com

123moviesfun(.)is

downace(.)com

watchmoviestream(.)me

customsdutyfree(.)com

allsp(.)ch

www(.)rarbgtorrent(.)com

cmacapps(.)com

speed-new(.)com

blogqpot(.)com

www(.)themetalup(.)com

cutewallpaper(.)org

o2tvseries(.)com

music(.)com(.)bd

manillenials(.)com

luchoedu(.)org

bosscast(.)net

kingdesi(.)com

www.legendofkorra(.)tv

deseneledublate(.)com

repack-games(.)com

amongushacks(.)com

wallpaperaccess(.)com

www.macappstores(.)com

softnspot.blogspot(.)com

btorrent(.)xyz

www(.)frkmusicx(.)com

www.()books-share(.)com

dbanimes(.)com

downloadpc-software.blogspot(.)com

apunkagameslinks.blogspot(.)com

naijatunez(.)com

freegogpcgames(.)com

venenosas(.)com(.)br

www.tumbral(.)com

www.twugi(.)com

gamemox(.)com

egyupgamer.blogspot(.)com

I have emailed AdMaven and Celebsupdates/Moviesupdates and several of the infected websites regarding this fraud but did not get any response.

I'm hoping a reputable security company or ad fraud company will expose this fraud further.

**UPDATE**

It appears the researchers at Bitdefender Labs are tracking the fake adBlock app as "Teabot and Flubot" but they seem unsure as to how the fake adblock app is being propagated.

I have tried to email Bitdefender to give them additional info regarding the malware and how its being spread through malvertising on the sites I listed above but Bitdefender's contact site is complete rubbish.

Bitdefender's article on the malware:

Bitdefender Labs

Daily source of cyber-threat information. Established 2001.

labs.bitdefender.com

Attached is a screenshot showing the malicious AdBlock.apk being advertised by the AdMaven script hosted on CloudFront:

One of the Android applications that people are frightened into downloading by the fake virus warnings is Psafe's DFNDR Antivirus/Cleaner.

Users have been tricked into installing DFNDR through fake virus warnings since 2013.

The developers claim that they do not condone these fraudulent ads and go so far as to ask users to send in screenshots of the fake virus warnings and the URL.

But this is just a ruse. It would be impossible to report on a single URL and the sites that push the fake virus warnings are created automatically.

The only way to truley stop the fake virus warnings is to go to the source of the fraudulent ads which is the AdMaven scripts hosted on Amazon's Cloudfront.

I have shared all this information with the representatives at Psafe about the fraudulent ads and how to stop it.

Psafe even requested I hold off on reporting of the fraud for 30 days which I granted but as you can see from these screenshots Android users are still being sent to the DFNDR app on the Google Play store through these scare tactics.

I have contacted Amazon to report the fraudulent ads and the drive-by downloads of the Android malware but they refuse to do anything about it.

Check the Play Store user reviews for yourself:

hxxps://play.google.com/store/apps/details?id=com.psafe.msuite&hl=en_US&gl=US