A newly discovered form of Android malware is draining batteries and gobbling up user data as part of a major ad-fraud operation.

Discovered by Oracle Corp. technology teams from its Moat and Dyn acquisitions, “DrainerBot” is being distributed through infected apps.

Infected apps, which have since been removed from the Google Play Store, include the augmented reality beauty app Perfect365, a sketching app called Draw Clash of Clans, music app Touch ‘n’ Beat – Cinema and VertexClub. The Oracle researchers say the apps have been downloaded more than 10 million times.

Running as a mobile ad scam, the infected apps run fraudulent, invisible video ads on an infected device. The app reports back to the ad network that each video advertisement has appeared on a legitimate publisher site but the sites are “spoofed,” not real.

An infected user sees nothing untoward since the ads don’t appear on the screen of the device, but where they may notice is in data and battery usage. The app can consume more than 10 gigabytes a month of data, likewise quickly draining the battery as well.

“DrainerBot is one of the first major ad fraud operations to cause clear and direct financial harm to consumers,” said Eric Roza, senior vice president and general manager of Oracle Data Cloud, said in a statement. “DrainerBot-infected apps can cost users hundreds of dollars in unnecessary data charges while wasting their batteries and slowing their devices. We look forward to working with companies across the digital advertising ecosystem to identify, expose, and prevent this and other emerging types of ad fraud.”

The researchers claim that the apps appear to have been distributed by a Dutch firm called Tapcore Inc., a company that assists app developers detect pirated installations of their apps, then displays targeted ads to the pirate app user.

Tapcore denied the allegation, saying in a blog post that it “strongly denies any intentional involvement with the supposed ad fraud scheme and is extremely surprised and alarmed by the allegations and attempt to connect the company with the scheme.”

It added that it has launched an internal investigation to see whether any such code was ever distributed through its network without its knowledge and that it “is ready to cooperate with all interested parties and provide all results on its findings.”

Photo: Marcin Wichary/Wikimedia Commons