A malicious Android app that displays advertisements and facilitates the download of additional malicious apps has infected over 45,000 devices in six months. 

Researchers at Symantec observed a surge in detections of the Xhelper app, which has mainly been targeting users in the US, India, and Russia. 

This annoying app, which bombards infected devices with pop-up advertisements, is tricky to find because it has been designed to not appear on the system’s launcher.

In addition to playing an irritating game of hide and seek, Xhelper has proved to be more tenacious than a 5-year-old in a candy store by repeatedly reinstalling itself on devices from which it’s been removed and even on devices that have been restored to their factory settings.

Researchers wrote: “We have seen many users posting about Xhelper on online forums, complaining about random pop-up advertisements and how the malware keeps showing up even after they have manually uninstalled it.”

With no app icon visible on the launcher, Xhelper can’t be launched manually. Instead, the malicious app gets its green lights from external events, leaping into action when a compromised device is rebooted, an app is added or removed from the device, or the device is connected or disconnected from a power supply. 

The launched malware has cunningly been designed to register itself on the device as a foreground service, lowering its risk of being quashed when the device’s memory is low. 

“For persistence, the malware restarts its service if it is stopped; a common tactic used by mobile malware,” wrote researchers.

Once Xhelper has settled into the device’s lounge and popped its feet up on the coffee table, it begins decrypting to memory the malicious payload embedded in its package. The payload then connects to the threat actor’s command and control (C&C) server and waits for commands.

“Upon successful connection to the C&C server, additional payloads such as droppers, clickers, and rootkits, may be downloaded to the compromised device. We believe the pool of malware stored on the C&C server to be vast and varied in functionality, giving the attacker multiple options, including data theft or even complete takeover of the device,” wrote researchers. 

Symantec first spotted Xhelper back in March 2019 when it was visiting advertisement pages for monetization purposes. Since then, the malicious app’s code has become more sophisticated, and researchers “strongly believe that the malware’s source code is still a work in progress.”