CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Trapdoor Android ad fraud operation leveraging 455 malicious apps and selective activation techniques disrupted

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A large-scale Android ad fraud and malvertising operation named Trapdoor was uncovered, utilizing 455 malicious utility-style apps and 183 threat actor-owned C2 domains to generate 659 million daily bid requests. The campaign operated as a self-sustaining revenue cycle, where initial app installs triggered malvertising that coerced users into downloading secondary apps, which then performed hidden ad fraud via automated touch fraud and concealed WebView ad requests. Traffic was predominantly U.S.-based, accounting for over 75% of volume, and the operation peaked at 24 million total app downloads. Selective activation techniques ensured fraudulent behavior was triggered only for users acquired through threat actor-run ad campaigns, while organic downloads remained unaffected. Google removed all identified malicious apps from the Play Store following responsible disclosure.

Timeline

  1. 19.05.2026 19:38 1 articles · 23h ago

    Trapdoor Android ad fraud operation with 659 million daily bid requests disrupted after responsible disclosure

    A large-scale Android ad fraud and malvertising operation named Trapdoor was disrupted following responsible disclosure to Google. The campaign used 455 malicious utility-style apps and 183 C2 domains to generate 659 million daily bid requests and 24 million total downloads, with over 75% of traffic originating from the U.S. The operation relied on a multi-stage fraud model where initial app installs triggered malvertising to coerce users into installing secondary apps, which then performed hidden ad fraud via automated touch fraud and concealed WebView ad requests. Selective activation via install attribution tools ensured fraudulent behavior was triggered only for users acquired through threat actor-run ad campaigns, while organic downloads remained unaffected. Trapdoor employed anti-analysis and obfuscation techniques, including impersonation of legitimate SDKs, to evade detection before Google removed all identified malicious apps from the Play Store.

    Show sources
    Open in new tab

Information Snippets