Google disrupts ‘SlopAds’ fraud campaign affecting hundreds of Android apps

In a blog post, HUMAN explains that many of these malicious apps share an AI theme and are mass-produced, which is why they named it “SlopAds”. Researchers say these apps hid themselves and used a bunch of tricks to bypass Google’s sophisticated security measures.

SlopAds traffic accounted for 2.3 billion requests every day, with the majority of them coming from the United States (30 per cent), India (10 per cent) and Brazil (7 per cent).

How did SlopAds campaign work?

When users installed any of the Slopads-infected apps from the Google Play Store, they operated as a normal app, showing no signs of malicious activity. But if you downloaded the app after clicking on a fake ad, the app gets downloaded alongside an encrypted configuration file that contains a malicious payload.

In case you are wondering, SlopAds hid a malicious APK archive in PNG images, which, when assembled, collected user and device data to send to a control server operated by the threat actor.

The complete malware, called FatModule, used hidden WebViews to navigate to promotional domains to generate ad revenue for the attackers. HUMAN says the campaign included more than 300 promotional domains and that the threat actors wanted ot expand their operation.

And while Google has removed all known SlopAds apps from the Play Store and updated Play Protect to warn users about the threat, the threat actors might relaunch their fraud ad campaign under a different name or wait for a while before striking again.