For bogus applications to be profitable, they should be able to entice users into installing them. Scammers do so by riding on the popularity of existing applications, embedding them with unwanted content—even malicious payloads—and masquerading them as legitimate. These repackaged apps are peddled to unsuspecting users, mostly through third-party app stores.
Haima exactly does that, and more. We discovered this China-based third-party iOS app store aggressively promoting their repackaged apps in social network channels—YouTube, Facebook, Google+, and Twitter—banking on the popularity of games and apps such as Minecraft, Terraria, and Instagram to lure users into downloading them.
Third-party app stores such as Haima rely on the trust misplaced not only by the users but also by distribution platforms such as Apple’s, whose Developer Enterprise Program is abused to deploy these repackaged apps. These marketplaces also appeal to the malefactors because they are typically less policed. Haima capitalizes on the monetization of ads that it unscrupulously pushes to its repackaged apps.