Security researchers have uncovered one of the largest mobile ad fraud operations in recent years, involving 224 apps on the Google Play Store with more than 38 million downloads globally.
The scheme, dubbed SlopAds, generated fake ad views and clicks in the background, siphoning advertising dollars without delivering genuine engagement to brands.
The operation was discovered by HUMAN’s Satori Threat Intelligence team, which reported the apps to Google. In response, Google removed the fraudulent apps and activated Play Protect, its built-in defense system that alerts users and prompts them to uninstall harmful apps.
According to researchers, SlopAds concealed its activities using steganography and WebViews—embedded browsers inside apps—allowing the apps to open hidden windows, navigate to cashout sites controlled by fraudsters, and generate fake impressions. At its height, the scheme was responsible for 2.3 billion bid requests daily, underscoring the scale of losses inflicted on advertisers. To remain undetected, the fraud only activated on apps downloaded after clicking on a SlopAds-controlled ad, while other downloads stayed dormant. Researchers described this tactic as a “novel abuse of marketing attribution technology,” reflecting the increasing sophistication of ad fraud.
“All users who have these identified apps installed on their device will receive a warning and will be prompted to uninstall them. Play Protect is on by default on Android devices with Google Play Services,” the report stated.
The fraudulent traffic spanned 228 countries and territories, with the largest share coming from the United States (31%), followed by India (11%) and Brazil (7%). Many of the apps, domains, and servers used in the scheme carried an AI theme, which inspired the SlopAds name.
Beyond generating fake traffic, the apps collected extensive device and browser data to optimize fraud operations. Encrypted instructions, delivered through Google’s Firebase platform, directed the apps to fraud modules, cashout sites, and scripts. In some cases, critical fraud components were hidden within PNG images, which were later reassembled into executable code on users’ devices.
The primary cash-out method involved HTML5 games and news sites owned by the fraudsters, where ads were displayed at high frequency in hidden WebViews. While advertisers paid for impressions and clicks, users never saw the ads. The scheme drained device resources for unsuspecting users while costing advertisers millions in wasted budgets.
This is not the first time fraudsters have exploited apps on the Google Play Store. In October 2024, Zscaler’s ThreatLabz revealed that over 200 malicious apps with nearly eight million downloads had targeted users. Nigeria was listed among the top ten countries most affected by such mobile malware campaigns, alongside India, the United States, Canada, South Africa, the Netherlands, Mexico, Brazil, Singapore, and the Philippines.
