Deceptive “Aftercall” Android Apps Flood Users with Post‑Call Ads via Overlay Permission Abuse
What Happened — Researchers at Malwarebytes identified a growing campaign of Android applications that masquerade as benign tools (alarm clocks, calendars, note‑taking apps, etc.) but, once installed, request the “draw over other apps” permission. After each phone call ends, the apps launch a full‑screen overlay that displays a pop‑up ad, then hide themselves from recent‑app lists, making removal difficult. Dozens of new apps appear each month, generating hundreds of millions of ad impressions through Google Play.
Why It Matters for Compliance & Audit Readiness
- The technique exploits weak permission‑granting processes, a classic failure of SOC 2 Access Controls (CC6.1 – logical access management).
- Continuous monitoring of device‑level permissions and evidence of policy enforcement are required to demonstrate due diligence in a SOC 2 audit.
- Security awareness training for end‑users and mobile‑device‑management (MDM) policies must cover overlay‑permission abuse to satisfy the “Security Awareness” control (CC6.2).
Who Is Affected – Consumer‑focused mobile app ecosystems, enterprises that allow BYOD Android devices, and any organization that relies on Google Play for internal app distribution.
Recommended Actions
- Review and tighten MDM policies to block or flag apps requesting “draw over other apps” or full‑screen notification permissions.
- Incorporate overlay‑permission checks into your continuous compliance tooling and retain audit‑ready evidence of denied/approved requests.
- Conduct targeted security‑awareness briefings that explain how deceptive overlay ads work and how users can safely deny such permissions.
Technical Notes – The apps monitor the telephony state (ringing → idle) and, upon call termination, invoke an activity using the overlay permission to present an ad. They also request full‑screen notification rights to appear on locked screens. No CVE is involved; the issue stems from permission misuse and social engineering. Source: Malwarebytes Labs