Lifting the Grey Curtain: Analyzing the Ecosystem of Android Scam Apps

Mobile applications (apps) are extensively involved in online scams. Previous studies mainly target
malicious
apps that either compromise victims’ devices (e.g., malware and ransomware), or lead to privacy leakage and abuse (e.g., creepware). Recently, an emerging kind of app
makes profits by providing scam services rather than compromising devices or abusing privacy
. We name these apps as
scamware
due to their deceptive behavior, which poses a new threat to (mobile) users. However, the characteristics and the ecosystem of scamware remain mysterious. This article takes the first step toward systematically studying scamware. In total, 1,262 ground-truth scamware are collected from December 1, 2020, to May 1, 2022. Specifically, we first investigate the social tricks used by scamware, and then analyze the participants and their relationships to demystify the ecosystem behind scamware. Finally, we reveal the scamware development features to facilitate the detection of scamware. Our study also gives some interesting findings, e.g., 1) the crowd-sourcing strategy is adopted to develop scamware, i.e., the
scammers
are the core members, while other participants are hired as peripherals; and 2) the online app generators have been abused to facilitate development; and 3) the money mule based payment is prevalent, and the case study shows the money flow is around
${\$}$
2,593,346 per day. We believe that our findings will facilitate the community and law enforcement agencies to mitigate this threat, and we will release the source code of our tools to engage the community.