Skip to content

Instantly share code, notes, and snippets.

View Skorpion96's full-sized avatar

Skorpion96

View GitHub Profile
@j3lte
j3lte / 0_README.md
Created May 27, 2026 11:05
Motorola Smart Feed — Affiliate Link Hijacking Investigation (DeviceNative SDK)

Motorola Smart Feed — Affiliate Link Hijacking Investigation

TL;DR

Motorola's pre-installed Smart Feed app (com.motorola.smartfeed) contains a third-party SDK called DeviceNative that silently injects affiliate-tracked app suggestions into the Motorola launcher. When users click what appears to be a normal app icon in their launcher's suggestion area, the click is intercepted and redirected through affiliate tracking URLs (america.devicenative.com / asia.devicenative.com) before landing on the destination. 144 apps are targeted across 16 markets, including Walmart, Target, Best Buy, Temu, AliExpress, Expedia, and more.

This investigation was performed through static analysis of APK version 1.03.0095 (build 361030095) using jadx and apktool, followed by live API queries to the DeviceNative server.