Massive SlopAds fraud campaign dismantled

BleepingComputer reports that Google and HUMAN were able to take down the global SlopAds Android ad fraud campaign, which involved 224 artificial intelligence-themed apps on Google Play generating 2.3 billion ad requests daily, with the U.S., India, and Brazil having the highest ad impression volumes.

Installation of the SlopAds apps through the attacker's ad campaigns prompted the subsequent exploitation of Firebase Remote Config to load an encrypted configuration file with ad fraud malware module, cashout server, and JavaScript payload URLs, findings from HUMAN's Satori Threat Intelligence and Research Team revealed.

After determining deployment on a real user's device, the illicit apps would download PNG images that leverage steganography to form the FatModule malware, which could stealthily obtain device and browser details before proceeding to attacker-controlled ad fraud domains.

Over 300 promotional domains were discovered to have been part of the SlopAds campaign's infrastructure, indicating potential expansion, according to HUMAN, who urged continued vigilance on similar intrusions despite Google's additional safeguards.