HummingBad Malware, Android

I am a passionate writer with a keen nose for the news and stories that matter. Sit back, relax and enjoy the tech ride with me as I take you into my own version of all things techie

This sounds like a doomsday scenario. Millions of Android devices around the world are being infected by a malware known as HummingBad. Actually about 10 million devices is the number Check Point is claiming are infected.

HummingBad Malware, Android
Android Malware

Check Point is a cybersecurity software maker which has being tracking the progress of the software since it was discovered in February. According to a released report by Check Point, the incidence of the virus around the world rose dramatically in the middle of May. This was after two months where the malware was infecting devices at a steady pace.

The amazing thing about the malware is that it originated from a group that is not even trying to hide who they are. I guess they can afford that since the malware is not particularly malicious to devices. What it does mainly is to send ads to infected devices. Also, it tricks devices into downloading softwares they don’t actually need.

Raking In Millions With HummingBad

The combination of these ads and downloads has netted the group, known as Yingmob, over $300000 each month. That is a nice slice of cash if you are based in Beijing with just about 25 people working in your outfit.

HummingBad Malware, Android
HummingBad raking in dollars

Yingmob is actually a legitimate business in the advertising niche. Making millions of dollars each year. So what is the motivation behind going into this sort of business for a legit firm? We might never get the real answers.

But a good guess is not to look any further than that $300000 they are getting monthly from the activities of HummingBad. A little extra cash can’t  be a bad thing anyhow you look at it.

Check Point’s blog post explain the situation better:

For five months, Check Point mobile threat researchers had unprecedented access to the inner-workings of Yingmob, a group of Chinese cyber criminals behind the HummingBad malware campaign. HummingBad is a malware Check Point discovered in February 2016 that establishes a persistent rootkit on Android devices, generates fraudulent ad revenue, and installs additional fraudulent apps.

Yingmob runs alongside a legitimate Chinese advertising analytics company, sharing its resources and technology. The group is highly organized with 25 employees that staff four separate groups responsible for developing HummingBad’s malicious components.

Yingmob uses HummingBad to control 10 million devices globally and generate $300,000 per month in fraudulent ad revenue. This steady stream of cash, coupled with a focused organizational structure, proves cyber criminals can easily become financially self-sufficient.”

HummingBad Malware, Android
Android Phone

Geographical Spread

The comprehensive report show that most of the infected devices are in China and India. In China  1.6 million devices are infected. While India has a total number of 1.35 infected devices. Other countries with high number of infected devices include Turkey, Philippines and Indonesia.

In the western world, the US has the highest number of devices infected with HummingBad. We are talking 288800 devices. In the UK, less than 100000 devices are infected. So also Australia.

In the larger picture of the hundreds of millions Android devices, these numbers might seem small. However it is worrying that it is even happening. Especially after the Android security report detailed the extend they’ve gone in reducing attacks such as this. I guess this is an incident that would feature prominently in next year’s report. Assuming no other incidence overshadows this case.

How HummingBad Works

HummingBad has two methods of infecting Android devices. Through downloads and  adult websites distributing x-rated content.

After gaining access into the phone, an attack is initiated when the malware attempts to gain root access to the device. If root access is gained, the malware now has full access to the Android device.

HummingBad Malware, Android
Rooting Android

Inability to gain access through root exploit would see the malware initiate another strategy. This time, a fake system update notification is sent to the device. Clicking the notification to update would see HummingBad gaining full root access to the device.

HummingBad now proceeds to install as many apps as possible on the device. Making money from that point is easy. Mainly through pop-up ads appearing on the installed apps.


image credit:;;