SlopAds Fraud Ring Exploits 224 Android Apps to Drive 2.3 Billion Daily Ad Bids

According to HUMAN’s Satori Threat Intelligence and Research Team, a large ad fraud operation named SlopAds ran 224 Android apps that attracted 38 million downloads across 228 countries and territories. The threat researchers noted that these apps used steganography and hidden WebViews to navigate to cashout sites controlled by the actors, generating fraudulent ad impressions and clicks.

At peak, the campaign accounted for 2.3 billion bid requests per day, with traffic primarily from the United States (30%), India (10%), and Brazil (7%), and Google has since removed all offending apps from the Play Store. The FatModule ad fraud module is delivered via four PNG image files that conceal the APK, which is then decrypted to gather device and browser information and conduct fraud using the hidden WebViews.

Domains linked to SlopAds include ad2[.]cc as a Tier-2 C2 server, and there are an estimated 300 domains advertising these apps. Gavin Reid, CISO at HUMAN, described SlopAds as illustrating the growing sophistication of mobile ad fraud, including conditional execution and rapid scaling.