If Android's safety features are intact (and nothing in the article suggests that they would be compromised), the adware can do only two things:
- use the permissions the "mother app" was equipped with
- trick the user into installing other apps, in order to deliver new payload and/or gain new permissions
Then the malicious software in the "mother app" or the newly installed app can abuse permissions it has. These abusable permissions include:
- Dialing phone numbers and sending SMS directly. The attacker can have your device call or message their paid service without your consent, pulling money out of your account.
- Reading contact details. They can get all your contacts' e-mail addresses and put them into a spam database.
- Reading/writing the filesystem, gaining access to confidential things you store there. I don't know if it exists yet, but a CryptoLocker for Android could also be possible.
My personal view is that this report has no real information value, it's just some antivirus software marketing or empty content to keep that blog running. I would not even call this a vulnerability, at least not an Android one. It is a human vulnerability. I mean, this kind of thing has been going on for ages. It's the "Don't believe the flashing
You're the 1000000th visitor, click here to claim your prize!,
Quick painless penis enlargement and/or Viagra for cheap and
Install our registry cleaner and speed up your PC" thing all over again. It's maybe meant to be a warning for people who install any seemingly interesting app that crosses their way without even checking the permissions.
From the Android system developers' view there can't be really much done to prevent this. They already really went out of their way to produce a platform that prevents accidental app installs and permission abuse, but there will always be a lot of gullible people who believe flashing ads so much that they disable security measures when they're asked to.
From the app developers' view: don't use ad providers you don't trust. Ad providers often provide obfuscated code for you to include in your app in order to prevent you from tampering with it to trick them. This also prevents you from understanding what the code does, and it could do exactly this kind of thing.