Viking Horde

Viking Horde is a mobile malware campaign that targets Android OS and is distributed via apps in the Google Play store. On both rooted and non-rooted Android devices, Viking Horde creates a botnet and routes connections through proxies in order to perform click-fraud for profit. On rooted devices, Viking Horde uses root access privileges to make removal of the malware difficult, or even impossible. It can also deliver additional malware designed for remote code execution.

Reporting and Technical Details

  • May 2016: Check Point Software Technologies Ltd. discovered Viking Horde bundled into the following apps in the Google Play Store: Viking Jump, Parrot Copter, WiFi Plus, Memory Booster, and Simple 2048. (Check Point)