Emerging Threats
What is an info-stealing ad library?

Written by a NortonLifeLock employee
Researchers have recently discovered more than 800 apps on the Google Play store that contain an information-stealing ad library dubbed Xavier. Google has been notified and has already removed a number of the apps containing the malicious ad library from the Google Play Store.


Don’t wait until a threat strikes.
Security threats and malware lurk on Windows PCs, Macs, and Android and iOS devices. If you use more than one device – like most of us do – you need an all-in-one security suite. Meet Norton Security Premium.
Enjoy peace of mind on every device you use with Norton Security Premium.
No Credit Card Required

What is an information-stealing ad library?
When it comes to free apps, there still may be a price, although it doesn’t always cost the user. There are other ways applications can earn revenue, such as running advertisements within the app itself. Ad libraries are a legitimate part of an application, however, they are software and can become compromised by cybercriminals in a myriad of different ways.
What does Xavier do?
This particular variant of the malicious ad library is what is known as a Trojan horse. This type of malware can collect sensitive user information such as email addresses, Device ID, device model, operating system version, country, device manufacturer, SIM card operator, screen resolution, and installed apps, all without the users knowledge.
How to stay protected from this type of threat
Taking advantage of quality security software such as Norton Mobile Security, which protects users from this particular threat, is an important measure you can take.
With Norton Mobile Security, you can also use our app advisor for Android to scan for "bad apps" like ones that contain Xavier before downloading them to your phone. Norton App Advisor is a special feature included with Norton Mobile Security. It notifies you if there are specific privacy risks, intrusive behavior of apps, excessive battery drainage and data plan usage.


Today’s attacks are multi-pronged. That’s why you need a layered approach to security.
Norton software blocks web-based attacks at the network level, before they ever reach your PC.
Now you can help protect against malware with Norton AntiVirus Basic.

Editorial note: Our articles provide educational information for you. NortonLifeLock offerings may not cover or protect against every type of crime, fraud, or threat we write about. Our goal is to increase awareness about cyber safety. Please review complete Terms during enrollment or setup. Remember that no one can prevent all identity theft or cybercrime, and that LifeLock does not monitor all transactions at all businesses.
Copyright © 2023 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries. Firefox is a trademark of Mozilla Foundation. Android, Google Chrome, Google Play and the Google Play logo are trademarks of Google, LLC. Mac, iPhone, iPad, Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Alexa and all related logos are trademarks of Amazon.com, Inc. or its affiliates. Microsoft and the Window logo are trademarks of Microsoft Corporation in the U.S. and other countries. The Android robot is reproduced or modified from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License. Other names may be trademarks of their respective owners.