What is HummingBad and do you have it

Last updated:

According to a report from Cyber security software company Check Point, recent updates to Android malware called HummingBad has infected more than 10 million smartphones and tablets, and could be installed on nearly 85 million devices around the globe.

In the report, Check Point wrote that it set out to learn more about how hackers conduct mobile malware initiatives. In the case of HummingBad, researchers spent five months examining the malware’s inner workings.

This investigation uncovered critical insights on how attackers conduct mobile malware campaigns:

  • The HummingBad campaign runs alongside a legitimate advertising analytics business, sharing
    their technology and resources, enabling it to control tens of millions of Android devices
  • The campaign generates $300,000 a month; proving attacks can achieve financial self-sufficiency

The latest body count in HummingBad’s efforts clocked in at around 10 million devices, but the numbers don’t stop there as it is estimated that the malware’s fraudulent ad revenue chalked in at $10,000 a day, or around $300,000 per month, implying that, “attacks can achieve financial sufficiency.”

While victims are spread worldwide, India and China take the lead.  The top 20 countries with infected devices have more than 100,000 victims each.

HummingBad Top 20 Countries
HummingBad Top 20 Countries

The malware is installing more than 50,000 apps a day and has been discovered on all versions of Android from Ice Cream Sandwich upwards.

HummingBad Android VersionsWhat is HummingBad

HummingBad is the brainchild of a group of developers called Yingmob. The team operates alongside a legitimate Chinese advertising and analytics company based in Beijing. The Yingmob shares its resources and technology with HummingBad. HummingBad is a move to generate ad revenue and earn hundreds of thousands of dollars. Simply by faking clicks on a device.

HummingBad started out as typical “drive-by attacks” where Android devices were infected after visiting a website, but has since grown into something much more powerful.

HummingBad works by attacking the root system of Android smartphones and tablets running Android Ice Cream Sandwich, all the way up to the latest Android 6.0.1 Marshmallow. If root access isn’t achieved, another level is granted (if successful) after the fake system update notification.

Once done the malware essentially takes over certain aspects of the device. From here it downloads apps from Stores, clicks ads online, and shares other malicious software. All of this ends up making Yingmob nearly $300,000 a month through false clicks and app downloads.

Check Point went on to say what “could” be done with this malware.

“The group tries to root thousands of devices every day and is successful in hundreds of attempts. With these devices, a group can create a botnet, carry out targeted attacks on businesses or government agencies, and even sell the access to other cybercriminals on the black market. Any data on these devices is at risk, including enterprise data on those devices that serve dual personal and work purposes for end users”

The research firm went on to state that YingMob could potentially sell information gathered from devices, or even sell access to a large group of devices on the black market.

Do you have HummingBad Malware?

No, most likely you do not have the HummingBad malware infection on your smartphone or tablet. From what we understand roughly 288,000 devices in the United States could be infected, and under 100,000 in the UK or Australia. It looks like bigger markets near the company like China are with 1.6 million, and India having possibly 1.4 million devices at risk.

The number is actually under 10 million in total, which is still a lot. The report states 84 million devices simply because YingMob has the reach to access that many devices. It doesn’t mean they’re all infected, or ever will be.

The scary part of this report is that only a small select group of devices had HummingBad malware installed, but in May they saw a huge spike, which spawned the report and findings to go public. At the end of the day you don’t have anything to worry about, especially if you use caution with what is clicked, where you download apps, and if you use secure devices with security measures like Samsung KNOX.

China and India are huge markets with millions of cheap Chinese knock-offs or budget devices with stock Android, outdated software with poor security, and other situations. The image above shows most infected are running outdated versions of Android.

Can I Check for HummingBad

While it looks like this malware isn’t all that much of a problem, especially in the UK or United States, and isn’t doing anything extremely malicious (aside from making phony clicks to earn tons of money) it’s still something users should somewhat be aware of.

No information has been released regarding how to check for HummingBad malware on devices, or how to remove it. That said, most likely your device is not infected. There are countless virus scanners and preventative apps on the Google Play Store that could scan and check for infections, if you feel the need.

A Google spokesperson stated:

“We’ve long been aware of this evolving family of malware and we’re constantly improving our systems that detect it,”

“We actively block installations of infected apps to keep users and their information safe.”

At the end of the day it’s all about using common sense. Only download apps from the Google Play Store, use caution in regards to what you click on or download, and be smart. Google’s continuously updating Android to be more secure, has promised monthly security patches and more.

My Cart Close (×)

Your cart is empty
Browse Shop

Rapid Mobile

Rapid Mobile uses cookies, tokens, and other third party scripts to recognise visitors of our sites and services, remember your settings and privacy choices, and - depending on your settings and privacy choices - enable us and some key partners to collect information about you so that we can improve our services and deliver relevant ads.


By continuing to use our site or clicking I Accept, you agree that Rapid Mobile and our key partners may collect data and use cookies for personalised ads and other purposes, as described more fully in our privacy policy.


You can change your settings at any time by clicking Manage Settings or by visiting our Privacy Centre for more detailed information.


Privacy Settings saved!
Cookie Services

We need your consent so that we and our trusted partners can store and access cookies, unique identifiers, personal data and information about your browsing behaviour on your device. This enables us to serve relevant content and advertising to you, and to improve the service that we provide to our readers. This only applies to rapidmobile.biz.Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our site.

We track anonymized user information to improve our website.
  • _ga
  • _gid
  • _gat

Save my preferences