A number of Android apps on Google Play that could have been downloaded by children have been serving up an unwelcome surprise: pornographic ads.
Security firm Check Point noticed the problem in over 60 apps; they contained hidden code that can display adult-oriented content, along with fake alerts claiming a virus has infected the device. All together, the apps—which include gaming- and drawing-related titles—were downloaded between 3 million and 7 million times.
Google said on Friday: "We've removed the apps from Play, disabled the developers' accounts, and will continue to show strong warnings to anyone that has installed them."
Google Play bans software that promotes sexually explicit content, and the company has safeguards in place to prevent malware-laden apps from infiltrating the platform. However, shady apps can still bypass those protections.
In this case, the hidden code inside the offending apps, dubbed AdultSwine, will either show pornographic ads from a third-party server or through the code's own ad library, Check Point said. "All these are displayed to children while playing the game that the app is masquerading as," the security firm added. The ads can also appear outside the app.
In addition, the hidden code can serve up scareware or other scams. For instance, pop-up ads can appear claiming a virus has been detected on the device. Clicking on the ads will redirect the victim to download a dodgy Android app called Goldeness Browser.
In an email, Check Point said Google is usually quite successful when blocking malware on the Play Store. However, the company's safeguards can have a harder time detecting "borderline" malicious activities like pornographic ads.
Although the offending apps managed to infiltrate Google Play, they never entered the company's "Designed for Families" program, which recommends software for children. Check Point has a full list of the names to 63 malicious apps here.