Could ads on your phone be hiding something more dangerous?

There are numerous types of malicious software that can infiltrate your phone. For example, spyware that can turn your device into a “bug,” Trojans that trick users into revealing sensitive information like bank passwords or credit card numbers, and ransomware that locks your device and demands a ransom to unlock it.

One threat that may seem more innocent, however, is adware. “It displays unwanted ads, but behind it, serious dangers are hiding,” warns Phil Muncaster from cybersecurity company ESET. According to ESET’s latest report, adware incidents increased alarmingly by 160% in the first half of 2025.

But what exactly is adware, and how does it work?

Not all adware is illegal. In its “innocent” form, it can be part of a free program that shows legitimate ads which cannot easily be disabled. Annoying, yes, but not necessarily dangerous.

However, there is a darker side: so-called potentially unwanted applications (PUA/PUP).

These apps:

• Flood your device with intrusive ads,
• Change settings without permission,
• And in more severe cases, steal personal data.

In general, adware refers to any unwanted or malicious software that displays advertisements on your device without your consent.

Ads can appear as:

• Pop-up windows,
• Browser-based ads,
• Banner ads,
• Push notifications,
• Full-screen content, even videos.

The goal of adware is to trick users into viewing or clicking on ads, ultimately generating profit—and sometimes even stealing money or sensitive data.

Additionally, these threats may:

• Track your online activity and show highly targeted ads,
• Steal personal information to sell to third parties,
• Automatically click ads without your knowledge to generate revenue for scammers,
• Hide on your device to prevent easy removal,
• Consume your data plan,
• Slow down your device,
• Open the door for more dangerous malware.

How Adware Gets on Your Device

Adware creators constantly find ways to trick users. Some common tactics include:

• Presenting it as a legitimate app,
• Bundling it with free software,
• Exploiting vulnerabilities in your device or its software,
• Luring users into clicking suspicious or fake ads,
• Displaying deceptive pop-ups (e.g., “Your device is infected!”),
• Sending malicious links via email, SMS, or social media.

How Adware Avoids Detection

Adware developers go to great lengths to remain undetected. They often hide it inside “legitimate” free software or present it as a system update. They also constantly modify it to evade security programs.

Introducing Kaleidoscope

A particularly advanced adware variant recently identified by ESET has been named Kaleidoscope. This is an ad fraud campaign targeting Android devices, using a “twin app” tactic. In this method, creators release two identical versions of the same app: one harmless version available on official app stores and one malicious version distributed through unofficial third-party stores. Deceptive ads then direct victims to the malicious version.

Alarmingly, both versions share the same name and app ID. This allows ad impressions from the malicious version to be recognized as legitimate by advertisers. As a result, cybercriminals earn revenue while victims are bombarded with ads that slow down their devices.

The statistics are revealing: adware accounted for more than a quarter (28%) of all adware detections on Android during the first half of 2025.

Could My Device Be Infected?

You may have adware on your Android device if you notice any of the following signs:

• The phone is slow or frequently freezes,
• Unknown apps, extensions, or toolbars appear,
• Websites fail to load correctly,
• You are flooded with excessive ads,
• Your browser homepage changes without consent,
• The battery drains unusually fast,
• Your data plan is consumed unexpectedly.

How to Avoid Adware

Fortunately, you can significantly reduce the risk of adware by following these guidelines:

• Download apps only from the Google Play Store and avoid unofficial app stores,
• Always check the developer and read reviews before installing,
• Avoid clicking on suspicious ads or pop-ups as they may be malicious,
• Keep your phone and browser updated to protect against vulnerabilities,
• Do not open links from suspicious emails, SMS, or social messages,
• Use trusted security software and ensure it is updated with PUA detection enabled.

What to Do if Your Device Is Infected

If you suspect your device has adware:

• Disconnect from Wi-Fi and mobile data,
• Restart in safe mode (process varies by device),
• Go to Settings > Apps & Notifications > See all apps and uninstall any suspicious apps,
• Clear browser cache and cookies if necessary.

“Alternatively, run a scan using reputable mobile security software,” advises Phil Muncaster from ESET. “By enabling PUA detection, you will get significant help in avoiding adware infections.”