Android apps with 2.5 million downloads are loading ads with the display off — delete these now

One phone with skull and crossbones on screen among several other clean-looking phones.
(Image credit: Marcos_Silva/Shutterstock)

Hackers have managed to upload 43 different adware apps with a combined 2.5 million downloads to the Google Play Store.

As reported by BleepingComputer, these adware apps were first discovered by the Mobile Research Team at McAfee who reported them to Google for violating the Play Store’s policies. While the apps themselves have since been removed from the Play Store, they could still wreak havoc on the best Android phones if you have any of them installed.

Unlike malicious apps that infect vulnerable Android phones with malware, adware apps show ads in the background to fraudulently earn money for their creators. What makes these 43 adware apps stand out is the fact that they were secretly showing ads while a phone’s screen was off.

Besides draining your battery, having an app show ads in the background can also eat up your mobile data and slow down your phone. Over time, you might even have to replace your smartphone as it no longer performs nor holds a charge like it used to.

Invisible adware

According to McAfee, these 43 adware apps mainly consist of streaming apps and news aggregators targeting users in South Korea. Still though, this same campaign could be used to target Android owners in the US, the UK and in other English-speaking countries.

You can find the full list in McAfee’s report but be warned, many of these adware apps use the same name but have different publishers. At the same time, many of these apps impersonate live TV services like DMB TV or music downloading apps.

McAfee refers to the apps in question as invisible adware as once installed on a smartphone, they wait several weeks before activating their ad-fraud activity. Not only does this help the apps bypass Google’s security checks but it also allows them to deceive users who installed them and get a higher rating on the Play Store.

Once their ad-fraud capabilities have been enabled, the apps prompt users to add them as an exclusion to Android’s power-saving system which puts apps into standby mode when a device is inactive. Android’s power-saving feature prevents apps from running in the background to save both battery life and system resources.

If a user does grant the adware apps this exception, they can then fetch and load ads when a device’s screen is off. While a user wouldn’t be able to tell this was happening, it allows the creators of these adware apps to defraud advertisers who thought someone was actually looking at their ads. 

McAfee says that users with an infected Android phone may be able to briefly see the ads loaded on their device when they unlock it. However, by going to Settings > Battery > Battery Usage, they would be able to see the real toll these adware apps have taken on their smartphone’s battery life.

How to stay safe from adware apps

A hand holding a phone securely logging in

(Image credit: Google)

Installing new apps onto your smartphone can certainly be useful but doing so can also be dangerous if you don’t do the proper due diligence first.

Before installing any new app onto your Android smartphone, you first want to check its rating and reviews on the Play Store. However, as app ratings and reviews can be faked, you should also look for external reviews on other sites. Video reviews can be really helpful here as you can see the app in question running on someone else’s smartphone before you decide to install it on yours.

To protect yourself from malicious apps and adware, you should also be using one of the best Android antivirus apps. If you’re on a tight budget though, Google Play Protect, which is free and comes preinstalled on most Android phones, can also scan your existing apps and any new ones for malware.

Finally, you want to be really careful when apps request access to certain permissions. With the adware apps described above, asking to be excluded from Android’s power-saving feature is a big red flag and a sign that something suspicious is going on. This isn’t always the case though as some apps do need to use Android’s accessibility features to function. More than likely though, an app could be malicious if it requests permissions that seem unreasonable. It’s up to you to think carefully before granting any app extra permissions.

These 43 adware apps have now been taken down from the Play Store but if you have any of them installed on your smartphone, you’re going to have to manually delete them yourself. 

More from Tom's Guide

Anthony Spadafora
Managing Editor Security and Home Office

Anthony Spadafora is the managing editor for security and home office furniture at Tom’s Guide where he covers everything from data breaches to password managers and the best way to cover your whole home or business with Wi-Fi. He also reviews standing desks, office chairs and other home office accessories with a penchant for building desk setups. Before joining the team, Anthony wrote for ITProPortal while living in Korea and later for TechRadar Pro after moving back to the US. Based in Houston, Texas, when he’s not writing Anthony can be found tinkering with PCs and game consoles, managing cables and upgrading his smart home. 

Read more
Green skull on smartphone screen.
Malicious Android apps with 60 million installs bombarding phones with ads and phishing attacks — how to stay safe
Best Android antivirus
The best Android antivirus apps in 2025
Google Play logo on an android smartphone with corner hole punch camera
At least 5 North Korean spy apps have been found on Google Play — what you need to know
One phone with skull and crossbones on screen among several other clean-looking phones.
Malicious iPhone apps are spreading screenshot-reading malware on the Apple App Store — how to stay safe
An image of a Google Android robot
Google blocked over 2.5 million suspicious Android apps from the Play Store last year
Green skull on smartphone screen.
Over 1 million Android devices infected with password-stealing, pre-installed botnet malware — how to stay safe
Latest in Android Phones
Galaxy S25 Plus held in the hand.
Samsung could delay One UI 7’s release in the US — here’s what we know
Android 16 screen-off fingerprint unlock in Settings menu
Android 16's latest beta lets all Pixel users unlock their phone more easily — here’s how
Galaxy S25 Ultra Now brief
Samsung’s Personal Data Engine is a big addition to the Galaxy S25 — here’s why
Samsung Galaxy S25 Edge next to Galaxy S25 Plus
Samsung Galaxy S25 Edge vs. Galaxy S25 Plus: Everything we know so far
Samsung Galaxy S25 Ultra vs S25 Plus vs S25
Satellite messaging on Google Pixel 9 and Samsung Galaxy S25 just landed on 3 more carriers
back of Iris Pixel 9a
The Google Pixel 9a is lacking one of the Pixel 9’s best safety features — here’s what we know
Latest in News
A first look at Amazon's Fallout TV series coming to Prime Video
‘Fallout’ season 3 plans are reportedly being made — while season 2 is still filming
Surface Laptop 7 from the front
Amazon just gave Surface Laptop 7 a 'frequently returned' label — here's what's going on
New emojis with iOS 18.4 beta release.
iOS 18.4 beta brings 8 new emoji to your iPhone — here's all the new options
23andME box
23andMe has declared bankruptcy — here's how to delete your data now
half-life alyx
Latest Half-Life 3 rumors point to a 2025 release — and maybe pigs will fly
NFL Sunday Ticket logo for YouTube
NFL Sunday Ticket 2025 pricing revealed — and it's bad news
  • Patterner
    it's 2023 and there is still no way to find all the apps on your phone that have been removed from the play store (and why)
    Reply