Word Template

This Check Point report analyzes the HummingBad Android malware campaign operated by a Chinese ad-analytics company (Yingmob). It describes a multi-stage campaign that uses rooting exploits and social-engineered update prompts to gain persistence, injects native libraries into Google Play to simulate install/click activity, fabricates device identifiers (fake IMEI), and silently or fraudulently installs apps to perpetrate large-scale ad fraud. The investigation provides scale metrics (~85 million devices reached, ~10 million malicious-app users), monetization figures (~$300K/month), component-level technical details (SSP, CAP, RightCore), code excerpts, command-and-control configuration samples, and numerous SHA-256 indicators of compromise.