Loading threat actor…
GhostAd is an Android adware campaign that abused official app-store distribution to reach large numbers of users through seemingly benign utility and emoji-editing applications. The operation relied on multiple Android apps published on Google Play and used persistent background activity to display intrusive advertising, consume device resources, and interfere with normal device use. The campaign has been associated with large-scale ad fraud behavior and misuse of legitimate advertising SDK functionality in ways that violated platform fair-use policies. Reported targeting has been concentrated in Southeast and South Asia, particularly the Philippines, Pakistan, and Malaysia. GhostAd is best characterized as a financially motivated mobile adware operation focused on monetization through unauthorized advertising activity rather than espionage or destructive effects.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
GhostAd is an Android adware campaign using popular apps to create persistent background advertising engines, draining device resources and generating fraudulent ad revenue.
GhostAd is an Android adware campaign that continues to evade detection and is present on the official Play Store.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.