Android.Phantom malware uses AI to commit ad fraud on infected devices
Android.Phantom malware reportedly used machine learning to automatically click ads on infected devices, spreading through over 155,000 compromised game downloads and modified streaming app versions. The malware incorporated TensorFlowJS to intelligently identify and interact with advertisements, generating fraudulent ad clicks on behalf of attackers.
What happened
A dangerous Android malware campaign called Android.Phantom emerged, targeting users through mobile games and pirated streaming app modifications. The threat employs machine learning technology to perform automated ad-click fraud on infected smartphones.
Over 155,000 downloads of compromised games were recorded. Six infected games from developer SHENZHEN RUIREN NETWORK CO., LTD. were discovered in the official GetApps store for Xiaomi devices, with updates released in late September introducing the Android.Phantom trojan. The malware also spread through modified versions of Spotify, YouTube, Netflix, and Deezer across unofficial platforms, dedicated modding websites, Telegram channels, and Discord servers.
Android.Phantom incorporates TensorFlowJS, a machine learning framework that enables intelligent identification and automated clicking of advertising elements displayed within hidden browsers on infected devices. The malware operates in two modes called phantom and signaling, with multiple interconnected variants including Android.Phantom.2.origin and Android.Phantom.5 functioning as droppers delivering remote code loaders.
Reported impact
Infected devices committed automated ad-click fraud, generating fraudulent interactions with advertising platforms controlled by attackers.
Index analysis
The deployment of TensorFlowJS within the malware enabled automated decision-making about which advertisements to click, bypassing traditional script-based detection methods. The AI model downloaded from external servers analyzed webpage screenshots to identify clickable advertising elements.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.