Skip to main content
Daily Record

Hundreds of Android apps infested with cyber attack with users told to delete immediately

Android users are being urged to lookout for alerts from Google.

Cyber crooks are once again attacking Android devices in an attempt to con innocent victims into parting with their personal and financial data.


In this current attack, users are being urged to immediately delete apps that have been infected by the new scam. The latest attempt from hackers to get some extra money in their pockets is through committing a sophisticated form of ad fraud.


By filling apps with corrupted ads, hackers are able to slow down the devices they have infected while lining their wallets. The new attack was spotted by the Satori Threat Intelligence and Research Team and is called SlopAds.


It has been discovered that 224 Android apps were impacted by this attack, which have been downloaded over 38million times through the Google Play Store app, reports the Express.

Security experts from the team explained: "HUMAN’s Satori Threat Intelligence and Research Team has uncovered and disrupted a sophisticated ad fraud and click fraud operation dubbed SlopAds.


READ MORE: Brits urged to create safe words as AI deepfake scams continue to rise

READ MORE: iPhone users solve mystery about why there are two ways to answer calls

"The threat actors behind SlopAds operate a collection of 224 apps and growing, collectively downloaded from Google Play more than 38 million times across 228 countries and territories.


"These apps deliver their fraud payload using steganography and create hidden WebViews to navigate to threat actor-owned cashout sites, generating fraudulent ad impressions and clicks. The threat actors’ infrastructure and many of the apps share an AI theme, contributing to the name of the operation."

READ MORE: Instagram adds new restrictions and more parental controls to teen accounts as mums blast 'evil' platform

It is important to note that Google has managed to remove all of the offending apps, which means that no new users will be impacted by ad fraud.

The Daily Record

Latest scam stories


For those who are worried that they have installed one of the apps that featured the SlopsAds bug, the security team say that all impacted users will be receive a warning and be prompted to uninstall the apps.

In order to protect from future attacks, all Android users are being urged to make sure Google's Play Protect feature in the app store is switched on.


This tool will warn users of potential corrupted apps before they install them, while also blocking any future apps that have exhibited behaviour associated with SlopAds.

Ad fraud isn't just harmful to device users, but also trusted advertisers and developers as hackers trick the network into allowing their infested ads.


Google explains: "Ad interactions generated for the purpose of tricking an ad network into believing traffic is from authentic user interest is ad fraud, which is a form of invalid traffic.

"Ad fraud may be the byproduct of developers implementing ads in disallowed ways, such as showing hidden ads, automatically clicking ads, altering or modifying information and otherwise leveraging non-human actions (spiders, bots, etc.) or human activity designed to produce invalid ad traffic.

"Invalid traffic and ad fraud is harmful to advertisers, developers, and users, and leads to long-term loss of trust in the mobile Ads ecosystem."

Article continues below

If Android users receive a warning to delete an infected app, they should follow the advice as soon as possible to protect their device.

Follow Daily Record:



GoogleSmartphonestechnologySamsungLifestyleFinancial crime
reach logo

At Reach and across our entities we and our partners use information collected through cookies and other identifiers from your device to improve experience on our site, analyse how it is used and to show personalised advertising. You can opt out of the sale or sharing of your data, at any time clicking the "Do Not Sell or Share my Data" button at the bottom of the webpage. Please note that your preferences are browser specific. Use of our website and any of our services represents your acceptance of the use of cookies and consent to the practices described in our Privacy Notice and Terms and Conditions.