AI-driven Android trojan covertly clicks hidden ads via phantom mode

Researchers have uncovered a new Android click-fraud Trojan family that uses TensorFlow.js to visually identify ad elements and automatically click them. It runs in two modes: phantom, which uses a hidden WebView-based browser to load pages and a loaded ML model to tap the correct UI elements, and signalling, which streams a live video of the virtual screen via WebRTC to allow attackers to perform actions in real time. The malware is distributed through Xiaomi GetApps by infected games, and via third-party APK sites and Telegram/Discord channels promoting modified apps. Impact includes battery drain and higher data usage; users are advised to avoid sideloading apps outside Google Play.