A well-known Chinese app developer Cheetah Mobile and one of its subsidiaries Kika Tech might have claimed credit for millions of dollars from advertisers through an Android fraud scheme, reveals app analytics firm Kochava.
It is a common practice for mobile app developers to generate revenue by marketing for new apps inside their apps for a meager bounty/fee, which generally ranges from $0.50 to $3.00. However, Kochava reveals that Cheetah Mobile’s 7 android apps and one app from Kika Tech are falsely claiming the credits for new apps installation and have claimed a bounty or fee. These 8 apps have a collective total of 2 billion downloads on Google Play Store.
These apps have been exploiting user permissions under an ad fraud scheme. Sharing its findings on BuzzFeed News, Kochava revealed that the scheme exploits the fact that most of the app developers pay a bounty or a fee to drive new installations of their applications. Cheetah and Kika Tech apps were involved in tracking users and when a new app was downloaded, these apps used the data to claim for credit as if these apps have caused the download.
See: Over 20 million Chrome users have installed fake malicious Ad Blockers
The practices of claiming false credit are called click flooding and click injection. To assess which ads are recommending a particular app, the newly installed application performs the “lookback” process soon after it is opened for the very first time.
Through lookback, the app can learn the location from where the last click generated and then attributes the installation. Kochava identified that Cheetah Mobile and Kika Tech were hijacking the app-install bounties even for those apps that got installed via other referrals.
Through click flooding and click injection companies are able to receive the reward for new app installation without playing any role in the advertising process. According to Kochava’s head of client analytics, Grant Simmons, this is no different than theft and the sad part is that both the companies involved in this fraud are established app developers.
“These are real companies doing it — at scale — not some random person in their basement,” Simmons said.
Cheetah Mobile’s utility apps are quite popular among users such as Battery Doctor and Clean Master, and the company is listed on the New York Stock Exchange too. Both Cheetah Mobile and the Silicon Valley-headquartered Kika Tech boast about having 700 million active users every month.
List of apps
Clean Master
CM File Manager
CM Launcher 3D
Security Master
Battery Doctor (removed by Google after BuzzFeed’s report)
CM Locker (removed by Google after BuzzFeed’s report)
Cheetah Keyboard
Kika Keyboard
This isn’t the first time that Cheetah Mobile has been accused of fraudulent business practices. Last year, Cheetah Mobile was accused of adopting deceptive business practices by an investment firm but the company categorically denied these charges.
See: Scammers editing bank details on Google Maps to defraud users
Responding to the allegations, Kika Tech claims that the company never engages in “fraudulent practices,” and it will do everything to “quickly and fully rectify” the issue while appropriate action will be taken against those involved in the fraud. On the other hand, Cheetah Mobile has put the blame on third-party software development kits and ad networks for click injection.
Kochava claims that the SDK involved in this fraud is also developed and owned by Cheetah Mobile and not by any third-party. In response to this, Cheetah Mobile asserts that its developed SDKs aren’t involved in this ad fraud. Google hasn’t issued any statement as yet but the company has confirmed that it is assessing the applications for fraudulent activities as reported by Kochava.
