SlopAds: How 224 Android Apps Fueled a $Billion Ad Fraud Scam in 2025
In late 2025, the SlopAds ad fraud ring was exposed running a sophisticated scheme across 224 Android applications, amassing more than 38 million downloads globally. The attackers covertly embedded steganography-based payloads within these apps, enabling them to generate hidden WebViews and surreptitiously route ad clicks and impressions to threat actor-controlled cashout sites. This campaign resulted in a staggering 2.3 billion daily fraudulent ad bids, undermining advertiser spending and trust in mobile advertising. Investigations revealed that the fraud operated across 228 countries and leveraged advanced techniques to evade security controls and detection. This incident highlights a growing trend in large-scale, automated digital ad fraud utilizing supply chain infiltration and advanced evasion. With mobile devices as primary attack surfaces and threat actors exploiting application distribution ecosystems, organizations face heightened regulatory scrutiny, financial risk, and an urgent need for granular visibility, segmentation, and anomaly detection capabilities.
Kill Chain
