Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid Requests Using 455 Apps

Trapdoor is a large-scale Android ad fraud and malvertising operation using 455 malicious apps and 183 C2 domains to generate fraudulent ad impressions.

• •The scheme tricks users into downloading utility-style apps (PDF viewers, device cleanup tools) that trigger malvertising campaigns coercing additional app installations.
• •Secondary apps launch hidden WebViews and load threat actor-controlled HTML5 domains to request ads, creating a self-sustaining revenue cycle.
• •At peak operation, Trapdoor generated 659 million daily ad bid requests with over 24 million total app downloads, predominantly affecting U.S. users.
• •The campaign uses selective activation techniques and anti-analysis obfuscation to hide malicious behavior from researchers and organic app users.
• •