Massive 'Trapdoor' Ad Fraud Campaign Unleashes 659 Million Daily Bid Requests via 455 Android Apps

A colossal ad fraud and malvertising operation dubbed 'Trapdoor' has been uncovered, flooding the programmatic advertising ecosystem with an average of 659 million bid requests every day, according to cybersecurity firm HUMAN's Satori Threat Intelligence and Research Team.

The campaign, active until recently, weaponized 455 malicious Android applications and 183 threat actor-controlled command-and-control (C2) domains. These apps unknowingly turned users' devices into a pipeline for multi-stage fraud, siphoning revenue from legitimate advertisers.

“Trapdoor represents a new level of sophistication in mobile ad fraud. The sheer volume of bid requests — nearly two-thirds of a billion daily — shows how organized and scalable these operations have become,” said Dr. Ellen Park, lead researcher at HUMAN Satori, in an exclusive interview.

Background

The scheme exploits Android's open ecosystem, distributing malicious apps through third-party stores and sideloading. Once installed, the apps establish persistent connections to C2 servers, receiving instructions to generate fraudulent ad traffic.

The infrastructure enabled multiple fraud techniques, including click injection, ad stacking, and fake traffic generation. All 455 apps collectively simulated real user behavior, making detection difficult for standard ad verification tools.

What This Means

For advertisers, Trapdoor drained budgets without delivering genuine impressions or clicks — a classic form of inventory spoofing. The 659 million daily bid requests represent potential losses of hundreds of thousands of dollars per day.

For Android users, many of the malicious apps were disguised as utilities, games, or entertainment tools. While they may not have displayed overtly malicious behavior, they consumed data and background resources, and could serve as gateways for further malware.

The campaign's takedown, led by HUMAN in coordination with Google and law enforcement, removed the C2 domains and notified app store operators. However, researchers warn that similar operations will likely emerge.

“This should be a wake-up call for the ad tech industry. We need stronger pre-bid filtration and real-time collaboration between security teams,” added Park. “Trapdoor might be down, but the playbook is now public.”

Further details are expected in an upcoming technical report from HUMAN Satori. In the meantime, users are advised to review installed apps and avoid sideloading from untrusted sources.