Phantom Malware in Android Game Mods Hijacks Devices for Ad Fraud

Researchers at Doctor Web reported an Android malware family called Android.Phantom distributed via modified game APKs and third‑party stores that runs covert ad‑fraud: it loads webpages in a hidden browser, downloads scripts and machine‑learning models to mimic user clicks, and can provide remote controllers real‑time interaction via WebRTC; affected apps appear to function normally while fraud runs in the background and the toolkit uses modular droppers and frequent updates to broaden its capabilities.