Adware apps still common on Google Play Store

TsSDK adware
Image Credit: Google (Image credit: Image Credit: Google)

Through the use of its mobile threat intelligence platform apklab.io, Avast has discovered 50 adware apps on the Google Play Store that have been installed anywhere from 5k to 5m times.

The security firm has dubbed the adware TsSdk because the term was found in the first version of the malicious apps that persistently display full screen ads and even try to convince users to install further apps.

The adware applications Avast discovered are linked together by the use of third-party Android libraries that bypass the background service restrictions present in newer versions of Android. While bypassing itself is not explicitly forbidden on the Play Store, apklab.io detects it as Android:Agent-SEB [PUB] because these libraries waste user's battery life and make their devices slower.

The adware apps themselves, use the libraries to continuously display more and more ads to users which goes against the Play Store's rules.

TsSdk

Through apklab.io, Avast found two versions of TsSdk on the Play Store that were linked together by the same code. The older of the two versions has been installed 3.6m times and was contained in gaming, fitness and photo editing apps most often installed in India, Indonesia, the Philippines, Pakistan, Bangladesh and Nepal.

Once installed, the apps containing the older version worked as intended but also created shortcuts on user's home screen with full screen ads shown when the screen is turned on and periodically when a user interacts with their Android smartphone. Some of the apps also contained code capable of downloading further applications, prompting users to install them.

Additionally, most of the older samples also added a shortcut to a “Game center” on the infected device's home screen which opens a page advertising different games.

The newer version of TsSdk has been installed almost 28m times through music and fitness apps. These apps were most installed in the Philippines, India, Indonesia, Malaysia, Brazil and the UK. The new version's code is encrypted using the Tencent packer and this makes it harder for analysts to unpack.

Several checks are also carried out before full-screen ads are displayed. The most important of which is the adware is only triggered if the user installs the app by clicking on a Facebook ad. The apps can detect this by using a Facebook SDK feature called “deferred deep linking”.

To avoid falling victim to adware, Avast recommends that users exercise caution when downloading apps, carefully check app permissions and install an antivirus app.

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Latest in Software & Services
woman listening to computer
AWS vs Azure: choosing the right platform to maximize your company's investment
A person at a desktop computer working on spreadsheet tables.
Trello vs Jira: which project management solution is best for you?
Autonomous finance
Quickbooks vs Quicken: what are the main strengths and weaknesses for your business
finance
Quickbooks vs Xero: which is the best for your business?
Group of people meeting
Zoom vs Google Meet: which is the best video conferencing tool for your business?
Fingers typing on a computer keyboard.
Microsoft 365 Personal vs Microsoft 365 Family: are there any real differences?
Latest in News
Apple iPhone 16 Pro HANDS ON
Leaked iPhone 17 dummy units may have given us our best look yet at all four models
A super close up image of the Google Gemini app in the Play Store
It's official: Google Assistant will be retired for phones this year, with Gemini taking over
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 16 (game #1147)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 16 (game #378)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 16 (game #644)
Three iPhone 16 handsets on show
Apple could launch an iPhone 17 Ultra this year – but we've heard these rumors before