'Konfety' Ad Fraud Uses 250+ Google Play Decoy Apps to Hide Malicious Twins

HUMAN Security uncovered the Konfety ad-fraud operation in which threat actors publish benign 'decoy' apps on Google Play and distribute malicious 'evil twin' versions through malvertising and compromised sites; the evil twins abuse the CaramelAds SDK to serve fraudulent ads at scale (peaking at ~10 billion requests/day), monitor user searches, sideload additional payloads, hide app icons, and establish C2 communications, enabling sustained large-scale ad fraud and privacy compromise.