Google has removed 224 Android applications after researchers discovered a global ad fraud campaign affecting millions of users. The operation, identified as SlopAds, exploited devices to create billions of fake ad impressions each day.
Global Impact
The apps, as per Humansecurity[1], were downloaded more than 38 million times across 228 countries. The campaign produced around 2.3 billion ad bid requests daily. The United States had the largest share of traffic at 30 percent, followed by India with 10 percent and Brazil with 7 percent.
Users who installed the apps directly from the Play Store without following ad links experienced normal app behavior. Only installations traced to specific ad campaigns triggered hidden malicious activity.
How the Campaign Worked
SlopAds apps used multiple methods to hide their activity. Once the apps confirmed a device was linked to a targeted ad campaign, they downloaded an encrypted configuration file from Firebase Remote Config. This file contained addresses for malware modules, cashout servers, and supporting scripts.
The apps then retrieved four PNG images containing fragments of the FatModule malware. Using steganography, these images concealed the malware, which was decrypted and assembled on the device. FatModule used hidden WebViews to collect device and browser information. It then accessed attacker-controlled websites designed to continuously display ads, generating billions of fraudulent impressions and clicks.
Infrastructure and Techniques
The campaign relied on multiple command-and-control servers and more than 300 promotional domains. Researchers noted the attackers selectively targeted devices based on marketing attribution tools. Only users arriving via certain ad campaigns were affected, which made detection more difficult.
The malware also included checks to detect debugging tools, emulators, or rooted devices, preventing analysis. Strings and code were encrypted, and parts of the software were packed to further hide malicious intent.
Effects on Users
SlopAds did not steal personal data, but the background activity increased battery usage, consumed mobile data, and could reduce device performance. Users may have experienced slower devices and higher operational strain.
Google Play Protect now warns users if any of the removed apps remain installed and prompts immediate removal. Security experts recommend keeping devices updated and running protective software alongside Play Protect.
Outlook
The scale and complexity of SlopAds suggest that similar ad fraud campaigns may appear in the future. Researchers continue to monitor the threat for new adaptations and warn users to carefully review app sources before downloading.
Full List of Package/App Names
- com.example.phonefinder
- com.device.locator.map.your.way
- com.fantasywallpaper.wallpaperlivebackground
- com.build.epic.plane.free.launcher.game.qwper
- com.build.queen.launhcer.puzzle.game.oqjnf9w
- com.cookie.dalgona.launcher.break.puzzle.wtrev
- com.doll.master.launcher.free.manage.desk.fgsae
- com.fingerheart.webgl.game.free.sdjws
- com.fruit.merge.launcher.game.free.cmaer
- com.onet.save.princess.free.puzzle.launcher.portn
- com.phone.puzzle.launcher.diy.game.awed
- com.rabbit.rush.cash.money.reward.game
- com.super.hero.shoot.puzzle.free.game.ponmr
- com.tanghulu.talent.free.sim.game.qwepo
- com.brain.drama.puzzle.game.free.qower
- com.bus.jam.screw.free.puzzle.launcher.lvose
- com.ice.cream.race.free.launcher.game.ta2j
- com.merge.zombie.war.launcher.free.m3gat
- com.munny.boney.cash.money.reward.fast.real.game.test
- com.punch.prankster.game.puzzle.fwaes.free
- com.puzzle.tile.match.beauty.puzzle.eliminate.free.game
- com.sprint.run.free.game.launcher.op1rm
- com.pixel.mysticspring
- com.photo.baby.unicorn.stickers
- com.Cyborg.CyborgCamera.FaceCamera.CyborgPhotoEditor
- com.berslex.tiktokofflinevideoplayer
- com.wifikeyview.wifikeyrecovery.wifi.passwordview.wifispeedtest.wifianalyzer.password.show
- com.onlineplayer.onlinemedia
- com.quickcash.gurujiapps
- com.palm.scanner.hand.reading.palm.jesus.viloria
- soft.apps.supper.torch.flashlight
- com.emojievolution.emojimixstickerhdia
- com.shoot.emoticon.arrow.puzzle.game.fsaw
- com.game.telepath.master.free.puzzle.gsawx
- com.game.snake.climber.car.fsawe.puzzle
- com.game.dalgona.cookie.party.free.puzzle.fisaw
- com.game.squid.sniper.puzzle.zwaex
- com.spooky.dool.master.puzzle.game.free.gneqx
- com.cat.pet.prank.game.free.puzzle
- com.resize.sponky.runner.game.puzzle
- com.emoticon.maker.free.launcher.puzzle.game.gsaew
- com.fingerheart.launcher.game.free.sdjws
- com.punch.prankster.puzzle.fwaes.free.launcher.fgsaw
- com.game.size.changer.race.puzzle.fsawx
- com.find.my.phone.launcher.clap.track.device.location
- com.videostreamplayer.vidstream
- download.videobrowser.videobrowser
- com.jkappsinc.hiddencameradetector.spycameradetector
- com.clwlpaprrewq.coolwallpaper
- com.dbffreebie.webview
- com.hisgeo.bacmarocijtima3iyatola
- com.AI.Generated.kylian.Wallpapers
- com.magicianslab.gifmaker
- com.as_ma3il.Calculate_your_need
- com.fakecallapp
- com.emoji.background.camera.photoeditor
- com.diy.tanghulu.asmr.game.puzzle.ewqgr
- com.spooky.hide.n.seek.game.puzzle.free.sfzsw
- com.spooky.craft.survivor.game.free.gwnh
- com.game.horror.beat.playground.puzzle.safwe.free
- com.resize.racer.gnwas.game.free.puzzle
- com.overtaking.challenge.free.puzzle.game.gawxr
- com.mr.hook.shoot.puzzle.hero.game.scmgn
- com.ngeue.mysticspring
- com.cosmic.launcher.live.wallpaper
- com.reelx.shgwk
- com.apapps.funny.girls.voiceeffects.voice.changer.free
- com.air.horn.haircut.prank.sound.clipper
- com.palmistry.ai.dress.launcher.android.aging
- com.apapps.bluetooth.autoconnect.pair
- com.ai.photo.tool.remini.baby.generator.gradient
- com.fluid.fx.live.wallpaper.magic.screen.simulation.credit
- com.all.video.downloadmanager
- com.emoji.maker.pro.launcher
- com.rodalsoft.wallpaper
- gesturelockscreen.patternlockscreen.lock.screen.signaturelockscreen
- com.tcminplay.superx
- com.tcminplay.goalonandroid
- com.smart.qrcode.barcode.object.pdf.scanner
- com.findmyphone.bywhistle.easilyfindphone.whistlephonefinder
- com.manissekincau.manisapp
- khawar_softs.blood_pressure_tracker.blood_pressure_checker.blood_pressure_diary.bp_checker_diary
- com.wifikeyrecovery.wifiautoconnect.wifipasswordshow.wifiautomaticunlock.internetspeedtest
- com.magnify.lab
- com.aura.launcherhsdprosdio
- com.nomanunseen.unseenmasterbd
- com.wSeeMePhotoEditor_8421281
- com.flashlight.plushhdfahdhisadh
- com.zoxtechapps.flashplayerforandroid
- com.rodalsoft.quranpro
- com.phone.cleanermaster
- com.nova.edit
- com.magnifier.superusagdasu
- apps.braceapps.highwayguide
- com.wellness.paljourneyhduaduas
- com.healthykeeper.keeperhealthyuoipop
- com.photoeditor.background.blur
- com.backyard.hole.digger.sim.gnwsz.game.free.puzzle
- com.emoticon.archer.blast.aewxz.free.game.puzzle
- com.horror.beat.box.music.game.free.puzzle
- com.agent.hamster.puzzle.game.free.gwezw
- com.drop.merge.brainrot.puzzle.free.launcher.tewon
- com.hole.collector.launcher.free.game.poute
- com.monster.beat.free.music.game.puzzle.flkgh
- com.mr.hero.shoot.puzzle.free.game.ponmr
- com.ninja.hunter.fnsia.game.launcher.puzzle
- com.roll.icecream.race.gajlr.launcher.free.game
- com.shape.shift.run.launcher.free.game.xjrtg
- com.game.size.shifting.runner.puzzle
- com.game.snake.car.climb.puzzle
- com.game.emotion.maker.pro.free.puzzle.gsawe
- cooking.cat.mama.restaurant.food.simulator.games.free
- com.clap.phone.finder.launcher.clap.track.your.device.locator.gps
- com.hassan.hirech.app
- com.smcallphone_nowda.tv
- com.gswave.paperwall.design.studio
- com.smart.alarmclock.sleeptrack.free
- com.birthdayphotoframemaker.birthday.photo.frame.birthdayphotoframeeditor
- com.livemap.onlinecams.gps.navigation.streetview
- com.muslimnet.radio
- com.fortunate.allvideoplayer.hdplayer.mediaplayer.freeplayer
- com.mobeasyapp.app472034232267
- com.video.fiesta.wathc.enjoy.trending.movies.streaming
- com.capy.bucks.cash.reward.earn.money.fast.real.game
- com.doge.save.puzzle.draw.free.game.zimet
- com.dop.brain.puzzle.launcher.free.limng
- com.draw.pee.puzzle.launcher.free.poiuy
- com.happy.draw.save.puzzle.launcher.stwen
- com.munny.boney.cash.money.reward.fast.real.game
- com.rush.earn.cash.money.reward.game
- com.block.buster.puzzle.line.blast.buster.game.free
- app.ai.wallpaper
- com.lacasadepapel.Game
- com.gurujiapps.earnguruji
- com.battery.emoji.style.home.screen.emoji.maker
- com.weather.genius.storm.track.forecast
- com.hassan.hirech
- khawarsofts.infinix_hot20.infinixhot20_themes.infinixhot20_wallpaper.infinixhot20_launcher.infinixhot20_icon
- com.screen.mirroring.cast.to.tv.max.hd
- com.popji.emoji.editor.maker
- com.idlemerge.candy.clash
- com.idle.risk.army
- com.live.weather.launcher.forecast.radar.android
- com.wIPtvandEcholinkFlash_9876226
- com.sub.ride.sub_ride
- com.anime.shimeji.desktop.pet.on.screen
- com.pixtune.ai.photo.editor.video.aiplay
- com.istanakuota.w38s
- ng.com.mony.giveaway
- com.dog.cat.translator.prank.sound.pet.speak
- com.super.light.torch.plus.max.sos.color.changer.for.iphone
- com.cine.flow.player.hd.hotfilms.video
- com.mziki.mzikimedia
- com.abdelhadii.iphone.ios15.wallpaper.photo.lockscreen
- com.ardrawer.paintsketchasihdo
- com.nova.meetyouraiashudias
- com.jameix.sounds.prank.best
- com.vintage_camera.polaroidcamera.photo_effects.photo_grid
- com.slideshowmakerwithmusicfree.photovideomaker
- com.emoticon.diy.znfav.launcher.free
- com.screws.story.match.choose.love.free.game
- screw.master.pin.jam.puzzle.nuts.bolt.casual.game.free
- com.hotpotgames.happysave.global
- com.stick.fight.dance.tuber.sdawe.puzzle.free
- com.capy.cash.earn.money.fast.real.rewards.game
- com.pdf.reader.viewer.word.sheet.ppt.reader.free
- merge.adventure.potion.girls.story.romance.sexy.game.free
- com.nicework.ninjameowautochess
- screw.it.bus.jam.puzzle.pin.nuts.bolt.casual.game.free
- com.lamvpn.vpnlam
- com.photoeditor.picswizshw
- com.twinfile.delete
- com.ggboyisanaItool.superlollipop
- com.cine.hunt.hd.immersive.high.movie.vieo.trending
- com.dop.fairy.puzzle.free.game.launcher.tungs
- com.scary.beat.game.puzzle.playground
- com.photo.emoji.studio.diy.merge
- com.artly.ai.photo.comic.photo.editor.hug.pixar.gippley
- com.outlook.weather.ai.forecast.storm.track.alerts
- com.smart.weather.forecast.radar
- com.kidslearn.abckids.kidsalphabets.colorskids210
- com.cnaature.app
- co.wl.aaghaz
- com.pdf.reader.document.viewerpdf
- com.mirroring.castv.chromecast.smarttv
- com.intelli.browserhdoaiwai
- com.pdf.reader.image.fast.free
- com.pet.ai.homii.assistant
- voice.translator.camera.text
- com.aigirls.aigirlfriends.virtualai
- com.squid.marksman.launcher.free.puzzle.sfawe
- sprint.run.level.again.sprunki.puzzle.troll.challenge.game.free
- com.arabola.bacolom
- com.acne
- com.magnifier.zoom.version.look.earth
- com.bns.code
- com.spooky.survival.free.puzzle.launcher.sanwe
- homeworkout.fitness.sixpacks.exercise
- com.hole.collect.master.launcher.free.game.apoil
- com.ice.cream.race.free.launcher.game.ta2j3
- com.dalgona.candy.party.cnvbj.free.game
- com.vido.vidoview
- com.sketappo.compass.simplcompass
- com.oxamsoul.worldenfender
- com.fastvideos.downloaderforfbandinsta
- com.Sketappo.all.data.recovery.allfilesrecovers
- com.lionsnowe.BraveFlashlight
- com.anime.girls.live.wallpaper.phone.ai.free.game
- com.spooky.survival.challenge.free.game
- com.jameixapps.storyeditor.storymaker
- com.photoeditor.beauticfnsahojf
- com.ragdoll.chaos.fight.free.launcher.game.ponme
- com.car.park.match.free.puzzle.jam.launcher.oilmv
- com.oops.croco.warcraft.wall.wow.clash.battle
- com.flix.zone.stream.chill.tv.video.watch.films.online
- com.frame.hub.vieo.enjoy.family.cinema.stream
- com.prank.silly.sound.machine.voice.air.horn
- com.pure.wallpapaer.live.hd.anime.launcher
- com.wonder.art.ai.photo.editor.warm.hug
- com.golden.tiger.win.earn.cash.money.game
- com.pdf.reader.viewer.word.sheet.ppt.reader.document
- com.ruby.cat.cash.earn.money.fast.real.game
- com.rush.cash.earn.fast.real.money.game
- screw.it.bus.jam.puzzle.pin.nuts.bolt.casual.game
Notes: This post was edited/created using GenAI tools. Image: DIW-Aigen.
Read next: OpenAI Tightens ChatGPT Access with Teen Protections and New Parental Controls[2]
References
- ^ Humansecurity (www.humansecurity.com)
- ^ OpenAI Tightens ChatGPT Access with Teen Protections and New Parental Controls (www.digitalinformationworld.com)