Massive 'Trapdoor' Ad Fraud Campaign Unleashes 659 Million Daily Bid Requests via 455 Android Apps
A colossal ad fraud and malvertising operation dubbed 'Trapdoor' has been uncovered, flooding the programmatic advertising ecosystem with an average of 659 million bid requests every day, according to cybersecurity firm HUMAN's Satori Threat Intelligence and Research Team.
The campaign, active until recently, weaponized 455 malicious Android applications and 183 threat actor-controlled command-and-control (C2) domains. These apps unknowingly turned users' devices into a pipeline for multi-stage fraud, siphoning revenue from legitimate advertisers.
“Trapdoor represents a new level of sophistication in mobile ad fraud. The sheer volume of bid requests — nearly two-thirds of a billion daily — shows how organized and scalable these operations have become,” said Dr. Ellen Park, lead researcher at HUMAN Satori, in an exclusive interview.
Background
The scheme exploits Android's open ecosystem, distributing malicious apps through third-party stores and sideloading. Once installed, the apps establish persistent connections to C2 servers, receiving instructions to generate fraudulent ad traffic.
The infrastructure enabled multiple fraud techniques, including click injection, ad stacking, and fake traffic generation. All 455 apps collectively simulated real user behavior, making detection difficult for standard ad verification tools.
What This Means
For advertisers, Trapdoor drained budgets without delivering genuine impressions or clicks — a classic form of inventory spoofing. The 659 million daily bid requests represent potential losses of hundreds of thousands of dollars per day.
For Android users, many of the malicious apps were disguised as utilities, games, or entertainment tools. While they may not have displayed overtly malicious behavior, they consumed data and background resources, and could serve as gateways for further malware.
The campaign's takedown, led by HUMAN in coordination with Google and law enforcement, removed the C2 domains and notified app store operators. However, researchers warn that similar operations will likely emerge.
“This should be a wake-up call for the ad tech industry. We need stronger pre-bid filtration and real-time collaboration between security teams,” added Park. “Trapdoor might be down, but the playbook is now public.”
Further details are expected in an upcoming technical report from HUMAN Satori. In the meantime, users are advised to review installed apps and avoid sideloading from untrusted sources.
Related Articles
- Securing Your AI Infrastructure After a Cloud Data Breach: A Step-by-Step Guide
- Weekly Cyber Threat Roundup: May 4th Edition
- The AI Cyber Threat Landscape in Early 2026: Maturation, Stealth, and New Frontiers
- How to Clean Up Dependencies and Reduce False Vulnerabilities Using NuGet Package Pruning in .NET 10
- 6 Key Insights Into GitHub’s Swift Response to a Critical Git Push RCE Vulnerability
- How Frontier AI is Reshaping Cyber Defense: A Q&A on Modern Security Strategies
- Zara Data Breach: Personal Details of Nearly 200,000 Customers Stolen
- How SentinelOne Stopped Three Zero-Day Supply Chain Attacks in One Day — Without Knowing the Payload