Popular Mintegral iOS SDK accused of spying and ad fraud

Tyrone Stewart

Chinese mobile ad platform Mintegral has been accused of spying on users and committing ad fraud dating as far back as July 2019 in more than 1,200 apps which represent over 300m downloads per month.

Malicious code was uncovered in iOS versions of Mobvista-owned Mintegral’s SDK by security company Snyk. This code is said to spy on user activity and potentially store personal information, while also fraudulently reporting user clicks on ads and stealing potential revenue from competing ad networks and the publisher of the app.

Apps which make use of the Mintegral SDK include popular apps such as Helix Jump, Talking Tom, Subway Surfers, Gardenscapes, and PicsArt.

Snyk worked with experts from the mobile advertising industry to discover the malicious code and found that, once the Mintegral SDK is downloaded by developers, it injects said code into standard iOS functions that execute when a URL is opened from within the app.

It was also found that the SDK modifies its behaviour through a number of ‘anti-bug protections’ in what appears to be an attempt to mask its malicious behaviours.

The main goal of the code appears to hijacking user clicks on ads from within apps. The Mintegral SDK is alleged to intercept all of the ad clicks – and other URL clicks – within an app and use this information to forge click notifications to the attribution provider, thus making it appear that the ad click came through the Mintegral network even though it may have been served by a competing ad network.

In response to the allegations, Mintegral released a statement on LinkedIn saying, “we would like to assure our clients and partners that these allegations are not true. We are taking this matter very seriously and are conducting thorough analysis of these allegations and where they are coming from. We have and will continue to uphold the highest standards of data privacy for users and our customers.

“To be fully transparent with our SDK and practices, we encourage our customers and partners to investigate this accusation through their independent data as well. We are confident that our customers and partners will reach the same conclusions, that is, there is no fraud taking place.”

Mobvista is a former content partner of Mobile Marketing