Over 50 Android Apps Found Spreading MagicAd Trojan via Official Stores
Over 50 Android Apps Found Spreading MagicAd Trojan via Official Stores
https://hackread.com/android-apps-magicad-trojan-official-stores/
Publish Date: 2026-06-15 06:02:00
Source Domain: hackread.com
A deceptive trojan is outsmarting Android’s built-in defences to bombard users with unstoppable background advertisements. Security analysts at Doctor Web recently found Android.MagicAd.1, a trojan malware that manipulates legitimate phone systems to force-feed ads even when all app windows are closed.
This is a frustrating trick, proving that ad-delivering threats are no longer just a minor nuisance but highly engineered tools designed to break safety rules.
The Infection Chain
Android.MagicAd.1 first appeared in 2025, but researchers say it is now being pushed through more than 50 infected games and utility apps. The malicious apps were not limited to shady download sites either. They were distributed through official app stores, including Samsung Galaxy Store and Xiaomi’s GetApps catalogue.
Some games and programs from the GetApps catalogue hiding Android.MagicAd.1 (Credit: Doctor Web)
To evade early detection by security scanners, the hackers rotated their apps, keeping them online for less than a month before swapping them with new versions. However, once downloaded, the trojan remained active on user devices.
The attack chain begins with hidden, encrypted components inside native code libraries. When a victim opens a compromised app, the malware decrypts these resources to extract a core component called Android.MagicAd.1.origin.
This Android malware also performs environment checks before launching its payload. It scans for virtual machines or blacklisted IP addresses to ensure it’s not being monitored by security researchers. If everything is clear, it hides its app icon from the home screen menu and schedules background tasks to keep itself running permanently.
Bypassing Android Restrictions
Researchers explained in the blog post that modern Android operating systems strictly forbid background apps from launching themselves or displaying windows over other programs without explicit permissions. Android.MagicAd.1,…
