Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesGoogle removed 41 apps linked to the Judy ad-fraud campaign from the Play Store in May 2017, after security researchers publicly described how the apps used Android devices to click ads automatically. Judy was a historical campaign, not a newly discovered threat. The reported download and revenue figures were estimates, and they do not establish how many devices were actually infected.
What was the Judy malware?
Judy was the name Check Point’s Mobile Research Team gave to an auto-clicking adware campaign it reported on May 25, 2017. Researchers found the campaign in 41 apps developed by a Korean company identified as Kiniwini, which was registered on Google Play as ENISTUDIO corp. The apps used infected devices to generate fraudulent ad clicks and revenue. (Check Point’s May 25, 2017 report)
Check Point also found Judy malware in apps from other developers, but said the relationship between those apps and the Kiniwini apps was unclear. The two groups should not be treated as one confirmed developer or as evidence of a single coordinated distribution effort.
How did Judy ad fraud work?
According to Check Point, the scheme used a staged process that could make an app appear benign during Google Play’s Bouncer screening. Once a user installed an app, it contacted a command-and-control server and downloaded a payload containing JavaScript, a user-agent string, and URLs selected by the attackers.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
- The app passed initial review: The seemingly harmless app was uploaded before its malicious behavior was activated.
- It fetched instructions after installation: The app contacted a command-and-control server and received the payload.
- It loaded target sites out of view: The app opened URLs in a hidden webpage and used a user-agent string designed to make the activity resemble a PC browser.
- It clicked ads automatically: JavaScript located and clicked banner ads served through Google’s ad infrastructure.
- The clicks generated revenue: The website developer was paid for the resulting ad traffic and clicks, even though they did not reflect genuine user interest.
Some apps also displayed many ads to users, at times leaving them with no option but to click one. That visible advertising was distinct from the campaign’s central fraud mechanism: hidden, automated interactions intended to manufacture ad clicks. (Check Point’s technical account)
How many apps did Google remove, and when?
Check Point published its findings on May 25, 2017. CyberScoop reported the next day that Google had removed 41 apps from the Play Store in the preceding 24 hours. The report described malicious code that opened webpages in the background and clicked banner ads; many of the apps were free games. CyberScoop said Google had not responded to its request for comment at the time. (CyberScoop, May 26, 2017)
What do the download and revenue estimates mean?
The figures reported in 2017 refer to different scopes and measures. Downloads are not the same as confirmed infected devices, and the broader estimate included apps by developers beyond Kiniwini.
Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
| Figure | What it describes | Qualification |
|---|---|---|
| 4.5 million to 18.5 million downloads | The 41 apps Check Point attributed to Kiniwini | Check Point Mobile Research Team estimate, 2017; downloads are not a confirmed count of unique infected devices. (Check Point) |
| 8.5 million to 36.5 million estimated spread | The wider set, including Judy-containing apps by other developers | Check Point estimate, 2017; not a count of confirmed unique infections. (Check Point) |
| About $300,000 per month | Estimated monthly revenue attributed to the campaign | A Check Point estimate reported by Forbes in 2017, not audited proceeds. (Forbes, 2017) |
Check Point said the actual spread was unknown because researchers could not establish how long the malicious code had been present in the apps. For that reason, none of these estimates should be recast as a verified infection total.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why could the apps evade detection?
The payload arrived after installation rather than being fully active in the app at the time it was uploaded. In a 2017 Forbes report, Android security researcher Sergio de los Santos of Telefonica’s ElevenPaths team explained that the apps were not dangerous by themselves in Google Play, but downloaded the payload after installation. He described the approach as “very tricky” and noted that the apps needed only internet access. (Forbes, 2017)
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Forbes also quoted de los Santos saying the clicking malware had gone undetected for years and that antivirus products were still not detecting it at the time. That was a historical observation from 2017, not a current comparison of antivirus products or evidence about what any particular product would detect today.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How does Google Play’s current policy treat ad fraud?
Google Play’s current Ad Fraud policy defines fraud as ad interactions that mislead an ad network into treating activity as genuine user interest. Its examples include hidden ads, automatic clicks, fake install attribution, ads shown outside an app, and a misrepresented app identity. Google says these practices harm advertisers, developers, and users. This is current policy context; it should not be mistaken for the exact wording of Google’s policy in 2017. (Google Play’s Ad Fraud policy)
Quick Recap
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
