Signature-based detection has an obvious weakness against adware: the families rebuild constantly. A new package name, a new signing key, a slightly different payload, and the app is "unknown" again. Meanwhile the user is still getting a full-screen ad every few minutes.

While building Impossible Adware Remover we ended up leaning on a much simpler signal: which app is putting windows on top of the screen, and how often .

The signal

An adware pop-up has to become the foreground window to be seen. On Android, an accessibility service receives window state changes along with the package name of the app that owns the new window. Most of those events are boring: the launcher, the app the user just tapped, the keyboard. Adware stands out because it takes the foreground when the user didn't ask for it, repeatedly, often right after unlock or on top of another app.

So the core logic isn't a database lookup.…