logo

Aftercall ads are driving Android users crazy

ID: 76e2fdae-a61b-5bb2-a9ff-cb1b1a140976

STIX ID: report--76e2fdae-a61b-5bb2-a9ff-cb1b1a140976

Feed Name: Malwarebytes Blog

Threat Score
60/100

Date Published: 2026-07-27

Date Updated: 2026-07-28

...
...

Aftercall is a widespread Android adware campaign in which apps masquerading as benign utilities (alarms, calendars, cleaners, etc.) trick users into granting "appear on top" and notification permissions so they can monitor call state and display full‑screen ads immediately after calls, often wrapped in fake “call info” screens; the apps also hide from the Recent Apps list, making removal difficult. The report describes delivery through Google Play, the overlay‑based ad mechanism, observed scale (dozens of apps, hundreds of millions of ad impressions), and recommended user mitigations (remove overlay permission, uninstall suspicious apps, enable Play Protect, use mobile security).

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.