Three adware apps discovered in Google Play use a special trick to ensure they stay on the victim device for a longer time. They pose as camera-related utilities and have recorded over 700,000 installations, combined.

Each app is listed under a different developer name and their only function is to display ads on the infected device. This aspect is reflected in the user reviews section where people complain about them being fake.

Simple stratagem for a long-lasting effect

To maintain persistence, the adware hides its default icon after launching the fake app for the first time and creates a shortcut for launching it. When the user tries to uninstall it, they can no longer do it from the home screen, where the only option they get is to remove the shortcut.

Lukas Stefanko, malware researcher at ESET, found the three apps, whose names are Excellent Camera, Ideal Camera: Full Featured Camera for Android, and Super Camera Lite 2019.

Uninstalling an app from the Android home screen was introduced with Android 6.0 "Marshmallow" and the action became the default for most users. Users just have to long-press the app's icon and drag it to the "uninstall" option.

It is easy to understand why this method gained popularity when the alternatives involve more steps.

The researcher explains in a video how the apps work and offers methods to get rid of them. One way is to do it from Google Play directly; another is to go to the App menu in the Settings area and select the app you want to kick out of the system.

Remove is not Uninstall



Found 3 apps on Google Play with over 700,000 installs that use interesting persistence technique.



When user realizes app is not as described, he can only remove the app icon not uninstall the app itself.



How it works I explained it in the video: pic.twitter.com/HrAVw6TTLq — Lukas Stefanko (@LukasStefanko) March 5, 2019

Stefanko is a seasoned researcher that reports offensive apps on Google Play all the time. Last year, he discovered multiple banking trojans disguised as astrology software.

Earlier this year, in January, he found a set of nine adware apps that together had been installed more than 8 million times; the large number

The problem seems to be difficult to eliminate, as the same month Stefanko reported 19 Android apps with over 50 million installs posing as GPS tools; what they did was to show an ad and then launch Google Maps.

At the moment of writing, all three of them are still available in the official Android app store. Although their rating and the user reviews are a clear indication to steer away, some users may still fall for them based on the promises in the description.

[IPDATE 03/06]: A Google representative contacted BleepingComputer saying the three adware apps mentioned in the article above are no longer available in Google Play.