Google Bans Android Developers With 200M Downloads Sued By Facebook For Ad Fraud (Updated)

On Wednesday, Facebook announced that it had filed its first lawsuit against two Asian developers for "click injection fraud—where developers made apps available on the Google Play store to infect their users’ phones with malware [which] created fake user clicks on Facebook ads that appeared on the users’ phones, giving the impression that the users had clicked on the ads."

But maybe no longer. At the time of first publishing this story, the developers—with more than 200 million downloads between them—continued to have apps available on Google Play. But, later on Wednesday, Google spokesperson Scott Westover contacted me to say that "these developers have been banned."

According to Facebook, LionMobi of Hong Kong and JediMobi of Singapore “generated unearned payouts from Facebook for misrepresenting that a real person had clicked on the ads." This is so-called click injection fraud, where automatic ad clicks are generated from (usually) viral apps without a user doing anything or being aware. As such, revenue is generated for the developers against the interests of the advertisers and Facebook. As users play on those apps, the fake ad clicks are being generated over and over again in the background. 

Last week, I reported that around 200 harmful apps on the Google Play Store had been downloaded more than 32 million times in July alone. Most of those downloads related to ad-fraud of one kind or another. Basically, threat actors planting fake or malware-laced ads on user phones or generating ghost clicks for payment.

The issue, though, is much larger and this is a warning shot for many other developers around the world—the lawsuit, Facebook says, "is one of the first of its kind against this practice." It is unlikely to be the last. In light of its data scandals, Facebook has demonstrated that it is now much more willing to head to court to keep its ecosystem in check.

"When we do the math, only on last month and only from available sources," ESET researcher Lukas Stefanko who exposed July's 32 million downloads told me, "not counting apps that could be there still hidden—this number [of fake apps] is huge."

Last year, Buzzfeed News reported that "eight apps with a total of more than 2 billion downloads in the Google Play store have been exploiting user permissions as part of an ad fraud scheme that could have stolen millions of dollars." All eight apps were Chinese in origin, with seven from a single developer, Cheetah Mobile. 

As I've said before, while we worry unnecessarily about viral crazes like FaceApp, the truth is that it's the apps we don't see coming that we should worry about, those apps we're downloading millions of times but which usually don't make headlines.