These "Royal Apps" create a Royal Pain

       Google Play still allows the most annoying of ad-ware to be distributed to Android devices.  Airpush and Leadbolt are still very popular and are becoming even more aggressive then ever before in pushing ads for money.  Examples like these "Royal Apps" from small unknown developers with no websites show up everyday.  These apps and ones like it are extremely flawed and most don't even have content other then the ads. Of the few that actually have content, it is even more rare to get one that gives the end user value.

Luckily for us though it isn't hard to spot an abusive Leadbolt or Airpush app. The ones on Google play will display a warning like the one to the left with an opt-out method.  Do not try to hit cancel then use the app it will still display the ads.  The Terms of Service (ToS) agreement has in the small print that activating that just starting the app is an agreement to display ads. Using the "opt-out" link will not help either as the push ads will start again after the app updates.  Please note that not all of the Leadbolt and Airpush apps follow the prescribed practice of using this ToS agreement and display ads anyway. It is ALWAYS a good idea to check app permissions and other user reviews BEFORE installing.  Upon reading the reviews below (and 100 more like them), it should be clear not to install this app.

If installed, prepare to be bombarded with thousands of these little icons that will appear every time the app starts and every time the device is reset. They will fill up the screens until there is no room left for more and keep coming back, even after deletion.

Clicking on any of them will bring up a webpage with even more advertising apps to download that will run even more apps for more ads.  Also be prepared to have random pop-ups for even more "shady" aps.  Like the one to the left for "Armour or Android", which purposely advertises on apps that it detects to make it look like the device is infected with something more threatening then just annoying ad-ware.

Examples of more pop-up ads below:

Stay safe out there
-R`/4N

Leadbolt Adware in Fraudulent "Cracked" apps.

A good article from GFI Labs shows the danger in downloading Android apps that advertise as being Cracked. Another review by Threatpost gives more information as well. The samples that can be found at getwapi[dot]com is just one of many apps that advertise cracks for paid software. You have to be very careful downloading stuff off alternate markets as  lot of "cracked" software can lead to stuff much more dangerous then just adware.  PJAPPS, which are valid software with malicious code added, can cost money and cause significant data loss.




After searching the site myself for a sample of the "cracked" software, I found that they where hosting apps on 4shared and it looks like they removed all of the fraudulent apps from the above GFI article.

"'MB Notifications for Facebook.apk' is unavailable. This file is no longer available because it's identical to file banned because of claim."

Luckily for me I managed to snag a copy before they where all removed. You can download the copy here. If you take a look at its Virus Total results you can see that it is LeadBolt adware. Leadbot, like most adware programs leaks data and can cause a massive drain on the battery of a device at the same time as hijacking ads and pushing new ads. Getting multiple copies of these apps running at the same time can cause a lot of confusion and be very annoying. Too many copies of this type of advertising and the android device will crash or become corrupt.

 I don't think that we will see the last of apps like this as already a sister site called runamux[dot]net has already been created and is hosting similar apps.  The best way is to not become infected with malware is to refrain from downloading potentially stolen apps from alternate sources. However, if you are going to "play" outside the confines of official markets like Google Play or Amazon, remember to download and protect your device with an antivirus mobile suite. Check out my blog post here for a few ideas or scroll to the bottom of the site for a list of free ones from Amazon.


Stay safe out there
-R`/4N