Security researchers have discovered one of the largest mobile ad fraud schemes in recent years, involving 224 apps on the Google Play Store with more than 38 million downloads worldwide.
The operation, dubbed SlopAds, secretly generated fake ad views and clicks in the background, stealing advertising dollars while offering no real engagement to brands.
The campaign was uncovered by HUMAN’s Satori Threat Intelligence team, which reported the apps to Google.
In response, Google removed all the fraudulent apps and activated Play Protect, its automatic defense system that warns users and prompts them to uninstall harmful apps.
According to researchers, SlopAds hid its fraud mechanisms using steganography and WebViews, simplified browsers embedded in apps.
“All users who have these identified apps installed on their device will receive a warning and will be prompted to uninstall them. Play Protect is on by default on Android devices with Google Play Services,” the report reads.
SlopAds’ fake ad traffic spanned 228 countries and territories, with most originating from the United States (31%), followed by India (11%) and Brazil (7%).
Many of the fraudulent apps, along with the domains and servers used in the campaign, carried an AI theme, which inspired the SlopAds name.
The apps also collected large amounts of device and browser data, allowing the fraudsters to tailor operations for maximum effectiveness.
Encrypted instructions, delivered via Google’s Firebase platform, directed the apps to fraud modules, cashout sites, and scripts needed to generate revenue.
In some cases, even the fraud management module was hidden inside PNG images, later reassembled on users’ devices to form executable code.
This is not the first time fraudsters are hiding under apps on the Google Play Store to defraud or attack users.
In October last year, Zscaler ThreatLabz research team revealed that more than 200 apps on the Google Play Store, downloaded nearly eight million times, were found to be malicious.
According to the report, Nigeria is one of the top 10 countries in the world targeted by these mobile malware attackers.
Other top targets include India, the US, Canada, South Africa, the Netherlands, Mexico, Brazil, Singapore, and the Philippines.