Tapcore’s software sleeps in the infected core for a while and then reaches out to the server to download the code for activating the DrainerBot. This sleep mode and then late process made it hard to identify its presence. Marketers are expected to be briefed about DrainerBot this week, by ads industry groups.