AdultSwine: Android Malware Installed On Millions Of Phones Exposed Kids To Porn

Security researchers discovered dozens of Android apps available through the Google Play Store—including a number of apps targeting children—that contained malicious code that would display pornographic material.

The infected apps were discovered and disclosed Friday by researchers at cyber threat intelligence firm Check Point. Google responded to the revelation by removing more than 60 apps from its app store. The apps were believed to be downloaded on as many as seven million Android devices.

Check Point dubbed the malware buried in the otherwise innocuous Android apps “AdultSwine.” Once the apps containing AdultSwine were installed on a device, the code would go to work displaying explicit content and trying to further ingrain itself onto the victim’s phone.

The primary function of AdultSwine is to serve up ads that were delivered from a command and control server operated by the attackers. The ads were often inappropriate and at times pornographic—a fact made particularly troubling as many of the apps were geared toward younger users.

In addition to displaying the explicit advertisements, AdultSwine also attempted to trick users into downloading other apps, including phony “security apps” that promised to help protect the device against malicious content. The malware would accomplish this by displaying advertisements in the victim’s web browser that claimed the device was infected or prompted them to download an app to remove a virus.

Finally, AdultSwine would attempt to get the user to sign up for premium services. Those services, typically costly text messaging scams, would charge the victim and generate profit for the attackers.

Researchers at Check Point warned that while the majority of AdultSwine’s functionality amounted to annoyance and small financial burdens, it had the potential to be much more damaging and could have been used to steal login credentials from victims, which could lead to sensitive information being compromised.

Many of the apps infected by AdultSwine were relatively obscure, but several were quite popular. One app, a game called “Five Nights Survival Craft,” had as many as five million downloads. Two other apps—including one called “Mcqueen Car Racing Game” that appeared to try to capitalize off the Pixar film “Cars”—has as many as one million installs.

A complete list of affected apps is available from Check Point .

While a number of the apps were targeted at children, none of them were a part of Google’s Family Link program, which helps parents identify kid-friendly apps. Those apps are subject to more stringent rules on advertisements to ensure none of the content displayed would be inappropriate for young children.

“We’ve removed the apps from Play, disabled the developers’ accounts, and will continue to show strong warnings to anyone that has installed them,” a spokesperson for Google told Gizmodo . “We appreciate Check Point’s work to help keep users safe.

While the devices have been removed from the Google Play Store, they may persist on a user’s device until the app is removed. Users should check to make sure none of the apps installed on their device have been infected by AdultSwine and use a legitimate antivirus tool in order to protect their device from being infected by malware.