Something injected ad to Firefox in my new android device - Android Q&A, Help & Troubleshooting

My phone: Xperia 1
OS: Android 9 (updated with latest update from Sony)
Today I woke up with my Firefox (default browser) showing this 3 ad links (which was automatically opened during my sleep):
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have this problem where my firefox suddenly opens weird links like sworkout.club or cryptocurrencytopnews.com while I am busy opening reddit / general browsing, playing games (do not disturb), and even during my sleep.
When it opens, my window directly switches to that page as if it is an Ad.
It happens maybe once few weeks ago but it happens almost every day and during my sleep.
What I have done:
I did use Malwarebytes, Avira, and Avast antivirus but none of them show potential risks.
I reinstalled Firefox, it didn't work. I reinstall ublock (the only add on I added myself) also this did not work.
Do you know what happens?
Can you help me diagnose and solve this?
Thanks in advance!
Further detailed info:
See
for extra illustration
Full app:
9292
nl.negentwee
AccuBattery
com.digibites.accubattery
Addons Detector
com.denper.addonsdetector
AirDroid
com.sand.airdroid
AliExpress
com.alibaba.aliexpresshd
Amazon Shopping
com.amazon.mShop.android.shopping
APKExtractor Lite
com.tutorialsface.apkextractorlite
App Backup Lite
com.ruet_cse_1503050.ragib.appbackup.lite
App Inspector
bg.projectoria.appinspector
AR effect
com.sonymobile.androidapp.cameraaddon.areffect
Authenticator
com.google.android.apps.authenticator2
Banking
com.ing.mobile
Blokada
org.blokada.alarm
Bookstores
com.ukbooks.store
Buienalarm
org.yoki.android.buienalarm
Business Calendar
com.appgenix.bizcal
Calculator
com.google.android.calculator
Calendar Notify
com.cliffcawley.calendarnotify
ColorNote
com.socialnmobile.dictapps.notepad.color.note
Compass
de.grewe.android.compassnoads
Connect
com.garmin.android.apps.connectmobile
ConvertPad - Unit Converter
com.mathpad.mobile.android.wt.unit
Digital clock Xperia™
com.sonyericsson.digitalclockwidget2
Discord
com.discord
Docs
com.google.android.apps.docs.editors.docs
Evernote
com.evernote
F-Droid
org.fdroid.fdroid
Firefox
org.mozilla.firefox
FlixBus
de.flixbus.app
Goodreads
com.goodreads
Google Opinion Rewards
com.google.android.apps.paidtasks
Google Play Games
com.google.android.play.games
HandWallet
mediavision.handwallet
HyperRail
be.hyperrail.android
idealo Shopping
de.idealo.android
IMDb
com.imdb.mobile
Kamus Offline
com.gits.bahasa
LastPass
com.lastpass.lpandroid
List My Apps
de.onyxbits.listmyapps
m365 Tools
app.peretti.m365tools
Malwarebytes
org.malwarebytes.antimalware
Marktplaats
nl.marktplaats.android
minimgur
com.minimgur
Movie Creator
com.sonymobile.moviecreator.rmm
My Stocks Portfolio
co.peeksoft.stocks
My T‑Mobile
nl.oberon.tmobile.my
MyFitnessPal
com.myfitnesspal.android
Neo HOTS
id.co.miraeassetdaewoo
NewPipe
org.schabi.newpipe
News Reader Pro
com.bionicapps.newsreaderpro
Nova Launcher
com.teslacoilsw.launcher
Nova Launcher Prime
com.teslacoilsw.launcher.prime
NS
nl.ns.android.activity
Office Lens
com.microsoft.office.officelens
Open Link With
com.tasomaniac.openwith
OpenVPN for Android
de.blinkt.openvpn
OV-chipkaart
nl.tls.ovchip
Passes
io.walletpasses.android
PayPal
com.paypal.android.p2pmobile
Periodic Table PRO
august.mendeleev.pro
Podcast Addict
com.bambuna.podcastaddict
Poet Assistant
ca.rmen.android.poetassistant
PostNL
nl.tpp.mobile.android
Prime Video
com.amazon.avod.thirdpartyclient
PUBG MOBILE
com.tencent.ig
QR Scanner
com.application_4u.qrcode.barcode
reddit is fun golden platinum
com.andrewshu.android.redditdonation
Sensors Multitool
com.wered.sensorsmultitool
Shazam
com.shazam.android
Sheets
com.google.android.apps.docs.editors.sheets
Skype
com.skype.raider
Slides
com.google.android.apps.docs.editors.slides
Smart Connect™
com.sonyericsson.extras.liveware
Smart Recorder
com.andrwq.recorder
Snapseed
com.niksoftware.snapseed
Solid Explorer
pl.solidexplorer2
Speedtest
org.zwanoo.android.speedtest
Start Running
com.axiommobile.running
Steam
com.valvesoftware.android.steam.community
Stellio
io.stellio.player
Stocard
de.stocard.stocard
Strava
com.strava
SwiftKey Keyboard
com.touchtype.swiftkey
Telegram
org.telegram.messenger
Thuisbezorgd
com.takeaway.android
TransferWise
com.transferwise.android
Translate
com.google.android.apps.translate
Vanced MicroG - 0.2.6.17455
com.mgoogle.android.gms
Video & TV SideView
com.sony.tvsideview.phone
Weather
com.sonymobile.xperiaweather
weawow
com.weawow
WhatsApp
com.whatsapp
WordWeb
com.wordwebsoftware.android.wordweb
WPS Office
cn.wps.moffice_eng
YouTube Vanced
com.vanced.android.youtube

---

Did you ever figure this out? I have same virus on my Note 8 and cant find any solution.

---

Hi,
Yes I solved it by trying to uninstall a group of apps.
The problem comes from one of these apps:
• 9292
• Addons Detector
• APKExtractor Lite
• App Backup Lite
• App Inspector
• Digital clock Xperia™
Good luck
--
Edit, something to add
Other user experienced similar issue and said that GPS Averaging was the problem.