BadNews: Mobile Attackers Pivot To Malicious Ads

Lookout discovered a large-scale Android malware campaign dubbed "BadNews" where malicious apps on Google Play (reported 2–9 million installs) connected devices to a fake advertising network to push fake news, malicious links and secondary payloads including a premium-SMS trojan (AlphaSMS). The malware used delayed activation to evade Google's Bouncer; Google removed the apps after notification. Lookout recommends continuous monitoring of third-party libraries and mobile application behavior to mitigate similar threats.