{"id":291761,"date":"2023-05-15T13:05:45","date_gmt":"2023-05-15T13:05:45","guid":{"rendered":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/"},"modified":"2025-03-13T20:32:35","modified_gmt":"2025-03-13T20:32:35","slug":"threat-lab-google-take-down-malicious-app-oko-vpn","status":"publish","type":"post","link":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/","title":{"rendered":"IAS Threat Lab collaborates with Google to take down malicious app"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"291761\" class=\"elementor elementor-291761\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"has_eae_slider elementor-section elementor-top-section elementor-element elementor-element-63f1ca16 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-eae-slider=\"68097\" data-id=\"63f1ca16\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"has_eae_slider elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-3539d9c2\" data-eae-slider=\"12996\" data-id=\"3539d9c2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2ddf8785 elementor-widget elementor-widget-text-editor\" data-id=\"2ddf8785\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The digital landscape is prioritizing privacy now more than ever before. Internet users worldwide understandably want to ensure security when browsing the web. However, fraud can be found anywhere \u2013 even in apps that may identify themselves as safe.<\/p><p><strong>The Scheme:<\/strong><\/p><p>The IAS Threat Lab recently uncovered an elaborate fraud scheme in a virtual private network (VPN) app targeting Android phones called <b>Oko VPN.<\/b> Developed by VIP Internet Security LTD., the app was labeled as a free VPN service that anonymizes a user&#8217;s web traffic and made available in the Google Play Store in July 2022.\u00a0<\/p><p>In reality, Oko VPN was hijacking IP addresses, turning users&#8217; phones into fraud-relaying devices. Any Android phone that installed the app unwittingly donated its IP address for use by Oko VPN to commit ad fraud. The fraudsters exploited the user&#8217;s IP address to mask the origin of traffic to send fake ad impressions to video streaming platforms. This IP hijacking scheme is referred to as \u201cresidential proxying.\u201d\u00a0<\/p><p>This app also posed a risk for illicit material\/traffic going through users\u2019 home networks, making it possible to make further attacks on users\u2019 home networks \u2013 which emphasized the need to remove the app from the Google Play Store immediately.<\/p><p><strong>The Takedown:<\/strong><\/p><p>Upon detecting the malicious app in March 2023, the IAS Threat Lab contacted the Google Play Store team who conducted their own investigation and confirmed the Threat Lab\u2019s findings. After the Threat Lab identified the scheme, IAS notified Google, which immediately removed the app and enforced Google Play Protect, which warns users and prompts them to uninstall the malicious app.<\/p><p><strong>The Impact:<\/strong><\/p><p>Oko VPN experienced exponential growth, with more than a million users at the time of its takedown. The Threat Lab team estimates that Oko VPN was generating approximately 100 million fraudulent impressions per month at the time of its removal from the Google Play Store. The team estimates that $10 million in advertiser spend was wasted on this scheme.<\/p><p>Fraud schemes like this are unfortunately quite common \u2013 and advertisers need to be aware. The IAS Threat Lab is constantly working to identify new and novel fraud schemes, protecting advertisers, publishers, and consumers from digital ad fraud.\u00a0<\/p><p>IAS established the Threat Lab to provide targeted reconnaissance of new and emerging fraud schemes. The team employs data analysis and reverse engineering to uncover fraud schemes and determine how they work, which allows the team to protect advertisers, publishers and consumers, by working with partners and authorities to take down the fraudsters.<\/p><p>For details on the scheme, <strong><a href=\"https:\/\/go.integralads.com\/rs\/469-VBI-606\/images\/AMER_Threat_Lab_Oko_VPN_Technical_Analysis_IAS.pdf\" target=\"_blank\" rel=\"noopener\">download the Technical Disclosure: Oko VPN<\/a>.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73d381d elementor-widget elementor-widget-pix-button\" data-id=\"73d381d\" data-element_type=\"widget\" data-widget_type=\"pix-button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<a  href=\"https:\/\/go.integralads.com\/rs\/469-VBI-606\/images\/AMER_Threat_Lab_Oko_VPN_Technical_Analysis_IAS.pdf\" class=\"btn m-0     btn-primary d-inline-block      btn-md\" target=\"_blank\" rel=\"noopener\"    ><span class=\"font-weight-bold \" >DOWNLOAD NOW<\/span><\/a>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The digital landscape is prioritizing privacy now more than ever before. Internet users worldwide understandably want to ensure security when browsing the web. However, fraud can be found anywhere \u2013 even in apps that may identify themselves as safe.<\/p>\n","protected":false},"author":59,"featured_media":292838,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[430],"tags":[435],"class_list":["post-291761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-lab","tag-threat-lab"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.4 (Yoast SEO v25.4) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>IAS Threat Lab collaborates with Google to take down malicious app - Integral Ad Science<\/title>\n<meta name=\"description\" content=\"Read how Integral Ad Science&#039;s Threat Lab defeated the malicious app Oko VPN in collaboration with Google.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"IAS Threat Lab collaborates with Google to take down malicious app\" \/>\n<meta property=\"og:description\" content=\"Read how Integral Ad Science&#039;s Threat Lab defeated the malicious app Oko VPN in collaboration with Google.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\" \/>\n<meta property=\"og:site_name\" content=\"Integral Ad Science\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-15T13:05:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-03-13T20:32:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"860\" \/>\n\t<meta property=\"og:image:height\" content=\"860\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"IAS Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@integralads\" \/>\n<meta name=\"twitter:site\" content=\"@integralads\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"IAS Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\"},\"author\":{\"name\":\"IAS Team\",\"@id\":\"https:\/\/integralads.com\/#\/schema\/person\/dbb1eb8d41477c4193f06c013629e755\"},\"headline\":\"IAS Threat Lab collaborates with Google to take down malicious app\",\"datePublished\":\"2023-05-15T13:05:45+00:00\",\"dateModified\":\"2025-03-13T20:32:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\"},\"wordCount\":436,\"publisher\":{\"@id\":\"https:\/\/integralads.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg\",\"keywords\":[\"Threat Lab\"],\"articleSection\":[\"Threat Lab\"],\"inLanguage\":\"en\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\",\"url\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\",\"name\":\"IAS Threat Lab collaborates with Google to take down malicious app - Integral Ad Science\",\"isPartOf\":{\"@id\":\"https:\/\/integralads.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg\",\"datePublished\":\"2023-05-15T13:05:45+00:00\",\"dateModified\":\"2025-03-13T20:32:35+00:00\",\"description\":\"Read how Integral Ad Science's Threat Lab defeated the malicious app Oko VPN in collaboration with Google.\",\"breadcrumb\":{\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#breadcrumb\"},\"inLanguage\":\"en\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage\",\"url\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg\",\"contentUrl\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg\",\"width\":860,\"height\":860},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/integralads.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IAS Threat Lab collaborates with Google to take down malicious app\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/integralads.com\/#website\",\"url\":\"https:\/\/integralads.com\/\",\"name\":\"Integral Ad Science\",\"description\":\"The Hidden Cost of MFA Webinar\",\"publisher\":{\"@id\":\"https:\/\/integralads.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/integralads.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/integralads.com\/#organization\",\"name\":\"Integral Ad Science\",\"url\":\"https:\/\/integralads.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/integralads.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png\",\"contentUrl\":\"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png\",\"width\":600,\"height\":600,\"caption\":\"Integral Ad Science\"},\"image\":{\"@id\":\"https:\/\/integralads.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/integralads\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/integralads.com\/#\/schema\/person\/dbb1eb8d41477c4193f06c013629e755\",\"name\":\"IAS Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en\",\"@id\":\"https:\/\/integralads.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9f16c6f50650cad445307fb6d3f416dd3bd43e25c36941c0d50911615af841de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9f16c6f50650cad445307fb6d3f416dd3bd43e25c36941c0d50911615af841de?s=96&d=mm&r=g\",\"caption\":\"IAS Team\"},\"url\":\"https:\/\/integralads.com\/insider\/author\/ias-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"IAS Threat Lab collaborates with Google to take down malicious app - Integral Ad Science","description":"Read how Integral Ad Science's Threat Lab defeated the malicious app Oko VPN in collaboration with Google.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/","og_locale":"en_US","og_type":"article","og_title":"IAS Threat Lab collaborates with Google to take down malicious app","og_description":"Read how Integral Ad Science's Threat Lab defeated the malicious app Oko VPN in collaboration with Google.","og_url":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/","og_site_name":"Integral Ad Science","article_published_time":"2023-05-15T13:05:45+00:00","article_modified_time":"2025-03-13T20:32:35+00:00","og_image":[{"width":860,"height":860,"url":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg","type":"image\/jpeg"}],"author":"IAS Team","twitter_card":"summary_large_image","twitter_creator":"@integralads","twitter_site":"@integralads","twitter_misc":{"Written by":"IAS Team","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#article","isPartOf":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/"},"author":{"name":"IAS Team","@id":"https:\/\/integralads.com\/#\/schema\/person\/dbb1eb8d41477c4193f06c013629e755"},"headline":"IAS Threat Lab collaborates with Google to take down malicious app","datePublished":"2023-05-15T13:05:45+00:00","dateModified":"2025-03-13T20:32:35+00:00","mainEntityOfPage":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/"},"wordCount":436,"publisher":{"@id":"https:\/\/integralads.com\/#organization"},"image":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage"},"thumbnailUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg","keywords":["Threat Lab"],"articleSection":["Threat Lab"],"inLanguage":"en"},{"@type":"WebPage","@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/","url":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/","name":"IAS Threat Lab collaborates with Google to take down malicious app - Integral Ad Science","isPartOf":{"@id":"https:\/\/integralads.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage"},"image":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage"},"thumbnailUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg","datePublished":"2023-05-15T13:05:45+00:00","dateModified":"2025-03-13T20:32:35+00:00","description":"Read how Integral Ad Science's Threat Lab defeated the malicious app Oko VPN in collaboration with Google.","breadcrumb":{"@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#breadcrumb"},"inLanguage":"en","potentialAction":[{"@type":"ReadAction","target":["https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/"]}]},{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#primaryimage","url":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg","contentUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/05\/Threat-Lab-Google-860x860-1.jpg","width":860,"height":860},{"@type":"BreadcrumbList","@id":"https:\/\/integralads.com\/insider\/threat-lab-google-take-down-malicious-app-oko-vpn\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/integralads.com\/"},{"@type":"ListItem","position":2,"name":"IAS Threat Lab collaborates with Google to take down malicious app"}]},{"@type":"WebSite","@id":"https:\/\/integralads.com\/#website","url":"https:\/\/integralads.com\/","name":"Integral Ad Science","description":"The Hidden Cost of MFA Webinar","publisher":{"@id":"https:\/\/integralads.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/integralads.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en"},{"@type":"Organization","@id":"https:\/\/integralads.com\/#organization","name":"Integral Ad Science","url":"https:\/\/integralads.com\/","logo":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/integralads.com\/#\/schema\/logo\/image\/","url":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png","contentUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png","width":600,"height":600,"caption":"Integral Ad Science"},"image":{"@id":"https:\/\/integralads.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/integralads"]},{"@type":"Person","@id":"https:\/\/integralads.com\/#\/schema\/person\/dbb1eb8d41477c4193f06c013629e755","name":"IAS Team","image":{"@type":"ImageObject","inLanguage":"en","@id":"https:\/\/integralads.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/9f16c6f50650cad445307fb6d3f416dd3bd43e25c36941c0d50911615af841de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9f16c6f50650cad445307fb6d3f416dd3bd43e25c36941c0d50911615af841de?s=96&d=mm&r=g","caption":"IAS Team"},"url":"https:\/\/integralads.com\/insider\/author\/ias-team\/"}]}},"_links":{"self":[{"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/posts\/291761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/users\/59"}],"replies":[{"embeddable":true,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/comments?post=291761"}],"version-history":[{"count":0,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/posts\/291761\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/media\/292838"}],"wp:attachment":[{"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/media?parent=291761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/categories?post=291761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/integralads.com\/wp-json\/wp\/v2\/tags?post=291761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}