More than 60 apps have now been removed from Google Play Store that were laced with AdultSwine Malware – A malware variant that displays pornographic adverts on users’ devices. Many of the apps that contained the malware were aimed at children, including Drawing Lessons Lego Star Wars, Mcqueen Car Racing Game, and Spinner Toy for Slither. The apps had been downloaded by between 3.5 and 7 million users before they were identified and removed.

While the malicious apps have been removed, users who have already downloaded the infected apps onto their devices must uninstall the apps to remove the malware. Simply deleting the apps from the Play Store only prevents more users from being infected. Google has said that it will display warnings on Android phones that have the malicious apps installed to alert users to the malware infection. It will be up to users to then uninstall those apps to remove the AdultSwine malware infection.

Apps Infected with AdultSwine Malware

  • Addon GTA for Minecraft PE
  • Addon Pixelmon for MCPE
  • Addon Sponge Bob for MCPE
  • AnimePictures
  • Blockcraft 3D
  • CoolCraft PE
  • DiadelosMuertos
  • Dragon Shell for Super Slither
  • Draw Kawaii
  • Draw X-Men
  • Drawing Lessons Angry Birds
  • Drawing Lessons Chibi
  • Drawing Lessons Lego Chima
  • Drawing Lessons Lego Ninjago
  • Drawing Lessons Lego Star Wars
  • Drawing Lessons Subway Surfers
  • Easy Draw Octonauts
  • Exploration Lite: Wintercraft
  • Exploration Pro WorldCraft
  • fidgetspinnerforminecraft
  • Fire Skin for Slither IO app
  • Five Nights Survival Craft
  • Flash Skin for Slither IO app
  • Flash Slither Skin IO
  • Girls Exploration Lite
  • Guide Clash IO
  • Guide Vikings Hunters
  • HalloweenMakeUp
  • halloweenskinsforminecraft
  • How to Draw Animal World of The Nut Job 2
  • How to Draw Batman Legends in Lego Style
  • How to Draw Coco and The Land of the Dead
  • How to Draw Dangerous Snakes and Lizards Species
  • How to Draw Real Monster Trucks and Cars
  • Invisible Skin for Slither IO app
  • Invisible Slither Skin IO
  • Jungle Survival Craft 1.0
  • Jurassic Survival Craft Game
  • Mcqueen Car Racing Game
  • Mine Craft Slither Skin IO
  • Moviesskinsforminecraft
  • Pack of Super Skins for Slither
  • Paw Puppy Run Subway Surf
  • Pixel Survival – Zombie Apocalypse
  • Players Unknown Battle Ground
  • San Andreas City Craft
  • San Andreas Gangster Crime
  • Shin Hero Boy Adventure Game
  • skinsyoutubersmineworld
  • Spinner Toy for Slither
  • Stickman Fighter 2018
  • Subway Banana Run Surf
  • Subway Bendy Ink Machine Game
  • Subway Run Surf
  • Temple Bandicoot Jungle Run
  • Temple Crash Jungle Bandicoot
  • Temple Runner Castle Rush
  • ThanksgivingDay
  • ThanksgivingDay2
  • Virtual Family – Baby Craft
  • Woody Pecker
  • youtubersskins
  • Zombie Island Craft Survival

Malicious Activities of AdultSwine Malware

AdultSwine malware, and the apps that infect users, were identified and analyzed by security researchers at CheckPoint. The researchers note that once downloaded onto a device, the malware sends information about the user to its command and control server and performs three malicious activities: Displaying advertisements, signing up users to premium services, and installing scareware to fool victims into paying for security software that is not necessary. Information is also stolen from the infected device which can potentially be used for a variety of malicious purposes.

The advertisements are displayed when users are playing games or browsing the Internet, with the adverts coming from legitimate ad networks and the AdultSwine library. The AdultSwine malware library includes extreme adverts containing hardcore pornographic images. Those images appear on screen without warning.

The scareware claims the victim’s device has been infected with a virus that requires the download of an anti-malware app from the Google Play Store, although the virus removal tool is a fake app. Users are told that their phone will be rendered unusable if the app is not downloaded, with a countdown timer used to add urgency.

Registering for premium services requires the user to supply further information, which is done through pop-up phishing adverts. The user is told they have won a prize, but that they must answer four questions to claim their prize. The information they supply is used to register for premium services.

Preventing Infection of Mobile Devices

Generally, users can reduce the risk of a malware infection by only downloading apps from official app stores, although this latest malware campaign has shown that even official stores can be compromised and have malicious apps uploaded.

Google does scan all apps for malware, but new forms of malware can be sneaked into Google Play Store on occasion. Google has announced that from the end of January it will be rolling out a new service called Google Play Protect that is capable of scanning previously downloaded apps to ensure they are still safe to use.

Google recommends only downloading apps for children that have been verified by Google as being ‘Designed for Families’. Those apps may contain adverts, but they have been vetted and strict rules apply covering the advertisements that can be displayed.

It is also important to install some form of anti-malware solution – from a reputable and well-known company – that will scan downloaded content and apps for malware.