Loading story…
A large-scale ad fraud operation, dubbed SlopAds, leveraged 224 Android apps with over 38 million downloads to generate up to 2.3 billion fraudulent ad requests per day. The campaign used novel techniques including steganography, multi-layered code obfuscation, and conditional activation based on installation source to evade detection. Google has removed the identified apps and enhanced Play Protect to block similar threats, but researchers warn these sophisticated tactics are likely to reappear.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcegovinfosecurity.com
Open sourcethehackernews.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026
Check Point researchers identified an Android malware campaign, dubbed **AdultSwine**, embedded in roughly 60 game applications on **Google Play**, many of them designed for children. The infected apps were downloaded an estimated **3 million to 7 million times** and used a command-and-control infrastructure to upload device information, receive configuration updates, hide app icons, and trigger advertising behavior after device boot or screen unlock. The malware displayed intrusive ads outside the host app, including pornographic content, while deliberately avoiding overlays on browsers and social networking apps to reduce user suspicion. The campaign monetized infections through multiple fraud schemes, including fake virus alerts that pushed users toward dubious “security” apps and bogus prize offers such as an iPhone giveaway that harvested phone numbers for **premium-service subscription fraud**. Researchers warned that the same remotely controlled delivery mechanism could be adapted for broader social-engineering attacks or credential theft, highlighting the risk posed by malicious apps that bypass platform trust and reach large numbers of mobile users through official app stores.
Aug 14, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026