Google Play Flooded With 224 Malicious Apps, 38 Million Downloads Deliver Malware

A global ad fraud operation named SlopAds involved 224 Android apps that together amassed more than 38 million downloads across 228 countries and territories. These apps, presented as AI-themed utilities, used obfuscation such as steganography and hidden WebViews to deliver a fraud payload that orchestrates billions of ad impressions and clicks for threat actor–owned cashout sites.

SlopAds relied on multiple C2 servers and promotional domains, with more than 300 domains linked to the campaign, and at its peak generated 2.3 billion bid requests per day, drawing traffic chiefly from the United States (30 percent), India (10 percent), and Brazil (7 percent). Google has since removed all 224 identified apps from the Play Store, and Google Play Protect provides install-time warnings and blocks behaviours associated with SlopAds, safeguarding devices on certified Android builds by default.

According to HUMAN’s Ad Fraud Defense telemetry, the campaign’s operators continue to evolve their toolkit and submit new apps to Google Play, underscoring the campaign’s ongoing persistence.