Portuguese 
English 
Spanish 
3 min of reading 
0 comments 
Google-Led Investigation Reveals How Common Apps Exploited Phones to Relay Third-Party Data Without User Consent in One of the Largest Operations Ever Identified on Android
A globally impactful technical operation was recently revealed after months of in-depth analysis. Since 2025, experts from Google identified the largest dismantling ever recorded of a residential proxy network based on Android devices, affecting over 9 million phones in different countries.
Initially, the traffic appeared normal. However, progressively, the investigation showed that millions of devices were being used, silently, as relay points for third-party data, without any knowledge on the part of the users.
According to the technical findings, the infrastructure was linked to the Chinese company IPIDEA, which was indicated as responsible for the development and distribution of the system that supported the operation.
-
Samsung launches cordless vertical vacuum cleaner with up to 400W of suction and relies on AI to automatically recognize corners, carpets, and different surfaces.
-
The lost continent beneath Europe: separated from North Africa about 240 million years ago, comparable in size to Greenland, Greater Adria was crushed over 40 million years and left geological marks from the Alps to the Balkans.
-
A cold front advances through the South this Saturday and reaches the Southeast on Easter Sunday with heavy rain and a drop in temperature, while the North and Northeast face the risk of storms and flooding throughout the holiday.
-
Brazil is about to inaugurate the largest maritime surveillance system in its history, with radars, infrared cameras, and autonomous sensors installed on Ilha Grande to monitor the entire Brazilian coast in real time.
Technical Structure Exploited Common Apps
First, IPIDEA inserted software development kits (SDKs) into hundreds of free apps, such as simple games and widely distributed utility tools. Then, after installation, the phones began to route external traffic, working as internet exit nodes.
In this way, the real identity of those sending the data was masked, while the traffic appeared to come from legitimate residential connections. Additionally, since the system utilized permissions already present in the Android architecture, it did not exhibit classic infection behaviors.
Consequently, it did not behave like traditional malware, making its identification by conventional security systems more difficult and extending its presence on devices.
Why the System Remained Invisible for So Long
Initially, the data volume seemed compatible with normal use. However, over time, Google researchers observed anomalous traffic coming from common residential IP addresses, which triggered internal technical alerts.
From this point on, deeper analyses revealed that the system operated in a grey area of digital security, where advanced technical practices did not immediately exceed the legal limits of malicious code.
However, still in 2025, the scenario worsened. The infrastructure of IPIDEA was hacked by criminals, who took control of the system and created the Kimwolf botnet, later used in distributed denial-of-service (DDoS) attacks.
Investigation Identifies Hundreds of Affected Apps
During the investigation, Google identified over 600 apps containing the IPIDEA code. In response, Play Protect was updated to automatically block these libraries within the official store.
Despite this, experts warn that users who install apps through alternative stores or APK files remain vulnerable. In this context, the origin of the app became a critical risk factor.
Furthermore, the case highlights how apparently legitimate data network and analysis operations can evolve into unauthorized exploitation, without adequate transparency to the end user.
Alert on Mobile Security and Digital Privacy
Digital security experts have been reinforcing, since 2025, a clear guideline: downloading apps from outside official sources significantly increases risks to privacy and the integrity of the home connection.
According to technical analyses, installing apps from unknown sources amounts to taking unnecessary risks with personal data and network infrastructure, as invisible functions may operate in the background for extended periods.
In light of this episode, which exposed structural flaws in the modern mobile ecosystem, to what extent do digital convenience and silent exposure still go hand in hand in users’ routines?
-
-
-
-
-
-
10 pessoas reagiram a isso.