tokens: It is important to note that the activity conducted by the malware is not borderline advertising , but definitely an illegitimate use of the users ’ mobile devices for generating fraudulent clicks , benefiting the attackers .