Loading malware…
SlopAds is a large-scale Android ad fraud operation involving malicious applications distributed through Google Play. The campaign used hundreds of apps presented as legitimate software and accumulated tens of millions of downloads across a broad global footprint. Its primary purpose was advertising fraud, generating massive volumes of fraudulent ad requests and fake ad interactions to monetize infected devices.
The operation used layered obfuscation and conditional activation to reduce detection. Reported tradecraft included downloading encrypted configuration data and using steganography to conceal malicious code within image files. The malware could behave like a normal application under some conditions while enabling fraudulent functionality only when specific criteria were met, a selective execution model that complicated app-store screening and analysis. Use of remote configuration and installation-origin telemetry has been associated with this activity to determine when malicious behavior should activate.
SlopAds targeted Android users globally, with notable impact reported in the United States, India, and Brazil. The campaign is notable for combining official app-store distribution, delayed or conditional malicious behavior, and heavy obfuscation to sustain a high-volume mobile ad fraud ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a comparison for selective activation controls used to hide malicious behavior in apps.
SlopAds is a malware campaign focused on ad fraud, using multiple layers of obfuscation to evade detection.
Android malware campaign responsible for large-scale ad fraud, using legitimate-looking apps to generate fake ad clicks and impressions, with advanced techniques like steganography and remote config delivery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.