{"id":4166,"date":"2025-07-29T15:41:33","date_gmt":"2025-07-29T13:41:33","guid":{"rendered":"https:\/\/www.mobisec.com\/?p=4166"},"modified":"2025-07-29T15:41:33","modified_gmt":"2025-07-29T13:41:33","slug":"mobile-fraud-the-wave-of-mobile-ad-fraud-in-2025","status":"publish","type":"post","link":"https:\/\/www.mobisec.com\/en\/news\/mobile-fraud-the-wave-of-mobile-ad-fraud-in-2025\/","title":{"rendered":"Mobile fraud: the wave of mobile ad fraud in 2025"},"content":{"rendered":"

In 2025, mobile security threats have evolved dramatically, exploiting the spread of Android apps, BYOD, and reliance on official marketplaces. The IconAds<\/strong>, mobile fraud operation represents a case in point: more than 350 infected Android apps, 1.2 billion fraudulent ad requests per day<\/strong>, and an adaptive capability that has been overcoming Play Store controls for years.<\/p>\n

But IconAds is just the tip of the iceberg. The mobile ecosystem is becoming a breeding ground for malware capable of generating advertising, financial and identity theft fraud. It is time for IT decision makers to address mobile security with a mature, structured and proactive approach.<\/strong><\/p>\n

IconAds: how new mobile fraud works<\/h2>\n

IconAds presents itself as a highly organized mobile ad fraud operation.<\/strong> The apps involved, also published in the Google Play Store, hide the icon from the launcher and display out-of-context advertisements that are part of mobile ad fraud campaigns<\/strong>. This behavior reduces usability, hinders app removal, and, most importantly, generates illicit ad revenue.<\/p>\n

Some apps even go so far as to simulate the icon of the Play Store or official Google apps<\/strong> to induce the user to click and trigger fraudulent activity in the background.
\nTo avoid expert analysis, IconAds disables malicious features if it detects that the app was installed from unofficial sources (sideloading). A resilient, dynamic network that is difficult to dismantle, with a massive fraudulent traffic base, particularly from Brazil, Mexico, and the United States.<\/strong><\/p>\n

The Kaleidoscope case: the good twin and the evil twin<\/h2>\n

In parallel, another campaign known as Kaleidoscope<\/strong> exploits a deceptive technique: twin deception.<\/strong>
\nTwo nearly identical versions of the same app are distributed:<\/p>\n