Cyber criminals are targeting Android devices once again to deceive unsuspecting individuals into revealing their personal and financial details.
Users are advised to uninstall compromised apps associated with a new scam immediately. This scam involves hackers engaging in a sophisticated form of ad fraud. By inundating apps with malicious advertisements, hackers can slow down the devices they have compromised while benefiting financially.
The recent attack, named ‘SlopAds’, was discovered by the Satori Threat Intelligence and Research Team. Researchers identified 224 Android apps affected by this attack, which have been downloaded over 38 million times from the Google Play Store.
Security experts from the team disclosed that they uncovered an intricate ad fraud and click fraud operation called SlopAds. The threat actors behind SlopAds manage a group of 224 apps, collectively downloaded from the Google Play Store more than 38 million times across various countries.
The malicious apps employ steganography to deliver their fraudulent payload and generate hidden WebViews to direct users to sites owned by threat actors for fraudulent ad impressions and clicks. The infrastructure of the threat actors and many of the apps share an AI theme, contributing to the operation’s name.
Google has successfully removed all problematic apps to prevent new users from falling victim to ad fraud. Users who may have downloaded apps containing the SlopAds bug will receive alerts prompting them to delete the apps.
To protect against future attacks, Android users are advised to keep Google’s Play Protect feature enabled in the app store. This feature warns users about potentially corrupt applications before installation and blocks any subsequent apps exhibiting behavior associated with SlopAds.
Ad fraud not only impacts device users but also legitimate advertisers and developers as hackers deceive networks into allowing their infected advertisements. Google highlighted that ad fraud involves generating ad interactions to deceive ad networks into believing traffic is from genuine user interest, leading to invalid traffic.
Android users are urged to act promptly by removing any apps identified as infected to safeguard their devices.