The sub-techniques beta is now live! Read the release blog post for more info.


HummingWhale is an Android malware family that performs ad fraud. [1]

ID: S0321
Platforms: Android
Version: 1.1
Created: 25 October 2017
Last Modified: 11 December 2018

Techniques Used

Domain ID Name Use
Mobile T1472 Generate Fraudulent Advertising Revenue

HummingWhale generates revenue by displaying fraudulent ads and automatically installing apps. When victims try to close the ads, HummingWhale runs in a virtual machine, creating a fake ID that allows the perpetrators to generate revenue.[1]