Android.MagicAd trojan displays ads despite all restrictions
Hot news | Threats to mobile devices | All the news | Virus alerts
Android.MagicAd.1 was distributed via GetApps, the official app catalog for Xiaomi devices, and was concealed in more than 50 games and programs. They were appearing in the app store for a short period of time—usually for up to a month, after which they would disappear and be replaced by the new ones. It is possible that this way, the threat actors were trying to protect Android.MagicAd.1 from premature detection; all that while maintaining its activity, because once removed from the store, the trojan programs remain on users’ devices and can continue performing malicious activities. Currently, none of the apps we identified as containing Android.MagicAd.1 are available for download in the GetApps catalog; and the developers who were distributing them have stopped adding new apps containing this trojan.
A study conducted by Doctor Web malware analysts showed that the first versions of Android.MagicAd.1 emerged in 2025, and that in addition to the GetApps catalog, they were also encountered in the Samsung Galaxy Store.
Examples of games and programs from the GetApps catalog in which Android.MagicAd.1 was concealed. At the time of this news release, these and other trojan modifications were unavailable for download
Part of Android.MagicAd.1’s malicious functionality is located in dex files hidden in encrypted native libraries, which are stored in the trojan’s file resource directory. While in operation, the trojan decrypts these libraries, and then extracts and runs its components from them.
Before proceeding to display ads, the trojan performs a number of checks to make sure its environment is safe. For example, it searches for signs that it is running in a virtual machine and verifies whether its installation was organic, whether the infected device’s IP address is in the malware’s black list, etc.
If Android.MagicAd.1 does not detect suspicious activity, it hides its icon from the apps list in the main screen menu. Next, it creates a notification channel, through which it launches several malicious persistence services necessary for the trojan app to work in the background when its window is closed. After that, using the task scheduler, Android.MagicAd.1 creates a task that periodically restarts services that check how the notification channel is working and restart it, if necessary. In addition, when running on devices with relatively old Android OS versions, the trojan launches a virtual screen so that the system cannot interrupt the work of one of its components.
To display ads in the background when its window is closed, Android.MagicAd.1 uses a number of techniques selected on the basis of the infected device’s manufacturer. At the same time, these methods are implemented without the explicit request for the system permission SYSTEM_ALERT_WINDOW, which allows the app to display itself on top of other programs’ windows.
Regardless of the technique used, all advertising banners are loaded as a Translucent Activity, which allows the trojan to draw them over the existing windows.
Examples of ads displayed by Android.MagicAd.1
One technique is implemented via Intents addressed to other programs. It allows the trojan to bypass the restrictions of modern Android OS versions, which do not allow programs to launch themselves. Depending on the infected device’s model, Android.MagicAd.1 uses this technique to either display ads itself or directly “force” target apps to show the advertising banners.
In one variation of this method, the trojan targets the following programs:
- Mi Browser on Xiaomi devices;
- Miui SystemUI graphical shell on Xiaomi devices; and
- Amazon Fire TV Home Screen launcher on Amazon TV devices.
All of these are system apps on the corresponding devices, so they can process intents even when not launched by the user directly. While they are active and can receive intents, Android.MagicAd.1 can use them to display ads.
It is worth noting that if Mi Browser is installed on a Xiaomi device as a non-system program, the trojan can also use it to show ads—until the browser window is closed.
When Android.MagicAd.1 detects Mi Browser on a suitable device, it sends its dex component (detected by Dr.Web as Android.MagicAd.1.origin) a pending intent for launching the advertisement. This dex forms its own intent from it and sends it to the browser, which extracts the initial intent and launches the advertisement corresponding to it.
The interaction with two other target programs slightly differs, as they are used to call the trojan from the background. First, Android.MagicAd.1 sends its dex component a pending intent for launching the ad; this dex then sends its own intent to the target apps so that they awaken it. If the target app is Miui SystemUI, this program responds by sending its intent to awaken the module. If the target app is Amazon Fire TV Home Screen, this app launches the module directly—using the name of the module’s program packet. Once the Android.MagicAd.origin module gains control, it launches the advertisement from the pending intent sent by the main malicious program.
If the trojan fails to display the ad, it tries this method twice more, and if that fails, it tries displaying the advertisement directly, without using pending intents and its malicious dex module.
Another variant of this method resembles the previous one and is used to exploit apps on Vivo devices. It differs in that advertisements are launched with the help of Android Binder, a system component that facilitates interaction between processes. The trojan targets the following system programs:
- iManager;
- Phonebook;
- Vivo Browser; and
- Baidu IME Customized.
Android.MagicAd.1 launches these programs via Android Binder by sending it regular intents via the Parcel data container. These programs then launch the Android.MagicAd.origin trojan component from the background, and it displays the advertisement.
Android.MagicAd.1 also has several other methods for displaying ads while running in the background, with using media player being one of them. Unlike the techniques that target specific devices, this method is universal and works on most Android device models from different manufacturers. Android.MagicAd.1 decrypts an audio file from its body and saves it to its work directory. Next, the malware launches an instance of the system media player, sets a minimum volume in it, and links the player with the Android OS global media control system. After that, to launch advertisements, Android.MagicAd.1 enables a broadcast receiver that monitors button clicks in this player. The trojan then uses a special adb command to simulate user behavior by pressing the record button in the player and then instantly closes the player’s window. Pressing the button triggers the system media receiver, which allows Android.MagicAd.1 to take control and launch the ad.
Dr.Web Security Space for mobile devices reliably detects and removes all known versions of the Android.MagicAd.1 malware, keeping our users well protected from this threat.
More details about Android.MagicAd.1
More details about Android.MagicAd.1.origin