Malicious Android 'Vapor' apps on Google Play installed 60 million times

Over 300 malicious Android applications downloaded 60 million items from Google Play acted as adware or attempted to steal credentials and credit card information. The operation was first uncovered by IAS Threat Lab, who categorized the malicious activity under the name "Vapor" and said it has been ongoing since early 2024. IAS identified 180 apps as part of the Vapor campaign, generating 200 million fraudulent advertising bid requests daily to engage in large-scale ad fraud. A newly published report by Bitdefender increased the number of malicious apps to 331, reporting many infections in Brazil, the United States, Mexico, Turkey, and South Korea. "The apps display out-of-context ads and even try to persuade victims to give away credentials and credit card information in phishing attacks," warns Bitdefender. Although all of these apps have since been removed from Google Play, there's a significant risk that Vapor will return through new apps as the threat actors have already demonstrated the ability to bypass Google's review process. The apps used in the Vapor campaign are utilities offering specialized functionality like health and fitness tracking, note-taking tools and diaries, battery optimizers, and QR code scanners. The apps pass Google's security reviews because they include the promoted functionality and do not contain malicious components at the time of submission. Instead, the malware functionality is downloaded post-installation via updates delivered from a comma...