Android Minecraft clones with 35M downloads infect users with adware

A set of 38 Minecraft copycat games on Google Play infected devices with the Android adware 'HiddenAds' to stealthily load ads in the background to generate revenue for its operators.

Minecraft is a popular sandbox game with 140 million monthly active players, which numerous game publishers have attempted to recreate.

The Minecraft-like games hiding adware were downloaded by roughly 35 million Android users worldwide, mainly from the United States, Canada, South Korea, and Brazil.



HiddenAds victim map (McAfee)

The most popular of the adware-ridden games (McAfee)

The advertisements are loaded in the background once the user launches the game, but nothing is displayed on the game screen.

Network traffic analysis, though, shows the exchange of several questionable packets generated by ad libraries of Google, AppLovin, Unity, and Supersonic, among others.

Suspicious network packets exchanged in the background (McAfee)

McAfee reports that the initial network packets on several of the apps share similar structures, using "3.txt" as the path in the form of "https://(random).netlify.app/3.txt," although the domains in each app are different.

Initial packets from three of the set's apps (McAfee)

This, in combination with the similar names of the games, suggests a possible connection between them, making it likely that the same author created the apps. However, McAfee does not explicitly mention any definitive links.

While adware apps aren't considered particularly dangerous for users, it can reduce the performance of a mobile device, raise privacy concerns, and even potentially create security loopholes that might expose users to nastier infections.

Android users should check McAfee's report for a complete list of affected apps and manually remove them if they have not been removed already.

Source: bleepingcomputer.com