A new research report by Check Point uncovered a massive Android adware operation called GhostAd.
The campaign involved apps pretending to be harmless tools, such as emoji packs and phone utilities.
Once installed, these apps secretly ran continuously in the background, without user awareness.
🔹 How GhostAd Damaged Android Phones
The infected apps loaded ads nonstop in the background without users opening them.
This caused:
🔋 Fast battery drain
🔥 Overheating
🐌 Slower performance
📶 Heavy internet data consumption
Even when users:
Closed the apps
Restarted the phone
Tried to stop running services
GhostAd automatically relaunched itself using the Android JobScheduler.
🔹 Fake Notifications and Stealth Techniques
The apps ran as a foreground service, but only showed a blank notification, making it look harmless.
The notification could not be removed, meaning the malware kept running in the background silently.
Many victims complained that the apps:
Showed ads every few seconds
Could not be uninstalled easily
Interfered with phone usage and privacy
🔹 Scale of the Attack
GhostAd included at least 15 malicious apps, and 5 were still on google Play during the investigation.
Combined, these apps reached millions of downloads.
One GhostAd app climbed to #2 in “Top Free Tools” on the Play Store.
Most heavily affected regions:
Philippines
Pakistan
Malaysia
With additional victims in Europe, Africa, Israel, and neighboring countries.
🔹 Google’s Response and Ongoing Risk
After being notified, google removed the malicious apps, and Play Protect now disables them automatically on affected devices.
However, GhostAd proves that even official app stores are not fully safe.
Users should be more cautious with free tool, utility, and emoji apps — even if they look harmless and have high rankings.
Disclaimer:
The information contained in this article is for general informational purposes only. While we strive to ensure accuracy, we make no warranties or representations of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability of the content. Any reliance you place on the information is strictly at your own risk. The views, opinions, or claims expressed in this article are those of the author and do not necessarily reflect the official policy or position of any organization mentioned. We disclaim any liability for any loss or damage arising directly or indirectly from the use of this article.
click and follow Indiaherald WhatsApp channel