New Android malware uses AI to commit ad fraud, bypassing traditional security defenses

Android Malware Exploits TensorFlow Machine Learning for Click Fraud

A new family of clickjacking trojans is using artificial intelligence to execute AI ad fraud on Android devices, marking a significant shift in how cybercriminals approach mobile threats. Security researchers at Dr. Web have identified malware that leverages TensorFlow.js, Google's open-source library for training and deploying machine learning models in JavaScript, to automatically detect and interact with advertisement elements1

1

. Unlike traditional click fraud schemes that rely on predefined JavaScript routines, this Android malware uses visual analysis powered by machine learning models to identify clickable ad elements, making it far more resilient against modern ad variability and behavioral detection systems3

3

.

The malware operates through two distinct modes that enable AI powered click fraud at scale. In phantom mode, the malware uses a covert WebView browser to load target pages on a virtual screen, where screenshots are continuously captured and analyzed by TensorFlow to identify relevant UI elements1

1

. By mimicking human ad clicks through tapping on the correct elements, the malware successfully evades traditional behavior-based defenses that flag automated clicking patterns. When automated interactions fail, the malware switches to signalling mode, which uses WebRTC technology to stream live video feeds of the virtual browser screen directly to attackers, allowing them to perform real-time actions like scrolling, tapping, and entering text2

2

.

Distribution Through Third-Party App Stores and Modified Apps

The cybersecurity threat has spread primarily through GetApps, Xiaomi's official app store for its devices, where threat actors initially submit clean applications before introducing malicious components in subsequent updates1

1

. Dr. Web researchers identified at least six infected games with over 155,000 cumulative downloads, including Theft Auto Mafia with 61,000 downloads, Cute Pet House with 34,000 downloads, and Creation Magic World with 32,000 downloads. All infected apps on GetApps are attributed to a single developer, Shenzhen Ruiren Network Co. Ltd2

2

.

Beyond GetApps, the malware has proliferated across third-party platforms including Moddroid and Apkmody, where researchers found that most apps on Moddroid's "Editor's Choice" page are infected1

1

. The trojans are also distributed through Telegram channels and Discord servers, with modified versions of popular applications like Spotify, YouTube, Deezer, and Netflix being weaponized to deliver the malware. One Discord server pushing an infected app called Spotify X had amassed 24,000 subscribers1

1

.

Impact on Users and Detection Challenges

While malware clicks hidden ads without posing an immediate data theft risk, the impact on users manifests through increased battery drainage, premature device degradation, and elevated mobile data consumption1

1

. Because the click fraud executes covertly in a hidden WebView rendering content on a virtual screen, victims see no visible indication of malicious activity, especially since many infected apps retain their core functionality1

1

. This operational stealth reduces user suspicion and allows the malware to operate undetected for extended periods.

Security experts warn that while clickjacking primarily targets ad networks and advertisers for financial gain, the remote hijacking capabilities demonstrated by the signalling mode could potentially be repurposed for more severe attacks, including data theft or targeting other users with infected APK files2

2

. The use of TensorFlow to adapt to dynamic ad formats that frequently change structure and often use iframes or video represents a concerning evolution in mobile threats1

1

. Users are strongly advised to avoid installing apps outside Google Play, enable Google Play Protect, regularly audit app permissions, and remain vigilant about downloading alternative versions of popular apps that promise extra features or free access to premium subscriptions4

4

.