During an internal threat-hunting investigation, Check Point researchers identified a network of Android applications on Google Play masquerading as harmless utility and emoji-editing tools.
Behind their cheerful icons, these apps created a persistent background advertising engine – one that kept running even after users closed or rebooted their devices, quietly consuming battery and mobile data.
At its peak, the campaign, now dubbed “GhostAd”, included at least 15 related apps, five of which were still available on Google Play at the start of our investigation. About 75% of targeted users appear to be from East and Southeast Asia, particularly the Philippines, Pakistan, and Malaysia with a smaller portion from other nearby countries and across Europe, Africa and Israel. This pattern is most likely a reflection of users who have downloaded these kinds of free “utility” apps, rather than an intentional choice by the operator.
Together, these apps accounted for millions of downloads, with one reaching the #2 position in Google Play’s “Top Free Tools” category.
Despite their wide reach and intrusive behavior, the apps remained available on Google Play at least since early October, continuing to attract new downloads. Users quickly began leaving reviews describing problems such as persistent pop-up ads, vanishing app icons when attempting to uninstall, and devices becoming slower or less responsive.
