AppLovin faces allegations of backdoor app installations amid record growth
Culper Research report reveals mobile advertising giant accused of using silent app installations to inflate numbers while e-commerce strategy draws scrutiny.
According to a February 26, 2025 report from Culper Research, mobile advertising technology company AppLovin has allegedly deployed a system that enables automatic app installations without proper user consent. The investment research firm claims the technology giant has incorporated permissions into thousands of apps that trigger silent app downloads directly onto users' devices.
The allegations come at a pivotal moment for AppLovin, which has recently reported exceptional growth. The company announced record financial results on February 12, 2025, with total revenue reaching $4.7 billion for 2024, a 43% increase from the previous year. Their advertising business, responsible for $3.2 billion of that figure, grew by an impressive 75% year-over-year.
The investigation published by Culper Research details a methodology by which AppLovin allegedly enables "backdoor installations" through an internal initiative called Array, launched in late 2022. According to the report, Array partners with mobile phone carriers and OEMs including T-Mobile/Sprint, Samsung, OPPO, RealMe, TCL, and Xiaomi to pre-load system-level software called AppHub onto devices. This software reportedly has permissions to initiate direct installations of third-party apps with just a single click.
The report further alleges that AppLovin has "smuggled" binding permissions into thousands of apps, including popular games like Subway Surfers, 8 Ball Pool, Wordscapes, and Angry Birds 2. When binding to AppHub, these apps inherit the ability to initiate installations of third-party apps from outside the Google Play store with minimal user interaction.
"First, we believe AppLovin's recent success in mobile gaming stems from the systematic exploitation of app permissions that enable advertisements themselves to force-feed silent, backdoor app installations directly onto users' phones, with just a single click – an event that is often inadvertent thanks to the Company's notorious UX gimmicks," states the Culper Research report.
The research firm contends that user complaints are widespread, citing forums including Reddit, T-Mobile, and Android Central where users report unexpected app installations. Google search interest for "AppHub" reportedly surged at three key points: Array's late 2022 launch, a May 2023 Samsung expansion, and a September 2023 OPPO expansion.
Culper Research presents a case study involving the game "Animal Restaurant," which allegedly triggered automatic installations of "Bricks n Balls," an app owned by AppLovin through its PeopleFun subsidiary. Third-party download data revealed unusual installation patterns coinciding with Array partnerships in Brazil and India.
The report also questions AppLovin's e-commerce advertising strategy, which has been a major factor in the company's recent growth. Culper Research alleges that AppLovin requires advertisers to first demonstrate proof of spending at least $600,000 per month on Meta (formerly Facebook) before joining the platform, allowing AppLovin to "see ads shown to Meta users" and potentially "take credit for the sale."
AdTech industry executives quoted anonymously in the report raised concerns about attribution validity. One executive described it as "a Ponzi scheme... with junk inventory, junk apps," while another questioned whether AppLovin "should get credit for the sale" when users complete purchases.
Culper Research also highlighted that in June 2024, Array updated its privacy policy to include a new section on "Direct Download Services," which they describe as a potential "CYA maneuver" despite the feature apparently being inherent to Array's existence from its launch.
The investment firm further notes that AppLovin founder and CEO Adam Foroughi previously worked at Claria Corporation (formerly Gator), which was known for its early spyware applications. It also points out that Foroughi's previous venture, Social Hour, was banned from Facebook advertising in 2009 due to "deceptive content."
These allegations come as AppLovin has announced plans to sell its gaming division for $900 million, focusing entirely on its advertising technology. In the last twelve months, insiders have reportedly sold nearly $2 billion in stock, while KKR has divested its entire remaining $7.3 billion stake in the company.
AppLovin has not yet responded to the allegations. The report indicates that Culper Research plans to write an open letter to Google Play and Google Play creators addressing concerns regarding potential policy violations that could affect the 1.4 billion daily active users that AppLovin's ads reportedly reach.
Timeline of key events
- Late 2022: AppLovin launches Array, partnering with carriers and OEMs
- May 2023: AppLovin announces expansion of Array partnership with OPPO
- September 2023: AppLovin expands Samsung partnership to Brazil
- June 2024: Array updates privacy policy to include "Direct Download Services" section
- February 12, 2025: AppLovin reports record financial results and announces plans to sell gaming division
- February 26, 2025: Culper Research publishes report alleging AppLovin's use of backdoor installations
The market will be watching closely for AppLovin's response to these allegations and any potential regulatory scrutiny that may follow.