I'm battling an adware on multiple Android devices which none of the Malware removal tools I tried (Kaspersky, Avast, and Norton IIRC) can find.
While the phone is locked, new Chrome tabs (not the default browser, Chrome specifically) are launched periodically, pointing at (don't visit!)
http://vpg.dorputolano.com. This redirects you to various ugly ad-sites for gambling, betting, new phones, and what have you. It doesn't act, while the phone is unlocked.
Importantly, this behaviour has jumped devices: I first had the issue on my OnePlus 3. I was changing phones anyway at the time and I thought with a fresh install on my new phone I'd be golden. I used the OnePlus transfer app to transfer my stuff to my new OnePlus Nord, which in hindsight might not have been the best of ideas. Now after ~3 weeks of using the new phone, it started again. No apps have been installed in this period, so it seems to have a dormant period before it starts acting up.
What I have tried
- Most obviously, switch to a brand new phone
- Finding rogue processes via
- Trying to change
/etc/hoststo at least not visit the bad site, but this needs root access
- Neither of my devices were/are rooted
- OnePlus Nord, Model AC2003
- Oxygen OS 10.5.10.AC01BA
- Carrier Wingo (read: Swisscom), not known for malicious behaviour
- (The old phone was a OnePlus 3, up to date with the last update they shipped)
I'm hoping for
- Identification of the malicious app and how to remove it
- Further tips on pinning it down myself, maybe more
- If all else fails, workarounds to mitigate the behaviour