HUMAN Reports Trapdoor Android Ad-Fraud Campaign Reached 659 Million Daily Bid Requests
Summary
HUMAN researchers describe Trapdoor, an Android malvertising and ad-fraud operation involving 455 apps and 183 C2 domains. It reportedly generated 659 million daily bid requests; Google removed identified apps after disclosure.
Key points
- HUMAN researchers attributed 455 malicious Android apps and 183 attacker-controlled C2 domains to the Trapdoor operation.
- The apps were downloaded more than 24 million times, and the campaign reached 659 million bid requests per day at its peak.
- Utility-style apps prompted users to install secondary apps that launched hidden WebViews, loaded attacker-controlled HTML5 domains, and requested ads.
- Attackers abused install-attribution tools to activate fraud for users acquired through their ad campaigns while suppressing it for organic downloads.
- The second-stage apps performed automated touch fraud; the initial apps used fake update alerts to encourage users to install them.
- HUMAN reported anti-analysis and obfuscation techniques, including impersonation of legitimate SDKs.
- Google removed the identified apps following HUMAN’s responsible disclosure.
Article Details
- Event Type
- Android ad fraud and malvertising operation using malicious apps, hidden WebViews, and install-attribution abuse.
- Impact
- Trapdoor involved 455 malicious Android apps and 183 attacker-controlled C2 domains. At its peak, it generated 659 million bid requests per day, and the associated apps were downloaded more than 24 million times. The activity used hidden ad requests and automated touch fraud to generate illicit revenue and support further malvertising.
People
Adam SellHUMAN researcher who detailed the Trapdoor operation and its app-based fraud pipeline.Gavin ReidHUMAN chief information security officer who commented on Trapdoor’s use of app installs and attribution tools.João MarquesHUMAN researcher who detailed the Trapdoor operation and its app-based fraud pipeline.João SantosHUMAN researcher who detailed the Trapdoor operation and its app-based fraud pipeline.Lindsay KayeHUMAN vice president of threat intelligence who commented on Trapdoor’s obfuscation and fraud techniques.Louisa AbelHUMAN researcher who detailed the Trapdoor operation and its app-based fraud pipeline.Ryan JoyeHUMAN researcher who detailed the Trapdoor operation and its app-based fraud pipeline.
Vendors
GoogleGoogle removed the identified apps after disclosure, ending a campaign that generated massive traffic and abused attribution tools to hide malicious behavior from organic users.HUMANHUMAN researchers uncovered Trapdoor, a new Android ad fraud and malvertising operation that used 455 malicious apps and 183 attacker-controlled C2 domains to build a multi-stage fraud pipeline.
Products
AndroidHUMAN researchers uncovered Trapdoor, a new Android ad fraud and malvertising operation that used 455 malicious apps and 183 attacker-controlled C2 domains to build a multi-stage fraud pipeline.Google Play StoreFollowing responsible disclosure, Google has taken steps to remove all identified malicious apps from the Google Play Store, effectively neutralizing the operation.