Google just took down 224 malicious apps with 38 million installs from the Play Store — how to stay safe
By Anthony Spadafora
Copyright tomsguide
Skip to main content
Tom’s Guide
Newsletters
View Profile
Search Tom’s Guide
You May Like
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
More than 250 malicious apps are spreading info-stealing malware on Android and iOS — delete these right now
This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this
Phone Insights
Phone Best Picks
Phone Deals
Phone Face-Offs
Phone How-Tos
Phone Reviews
Network Carriers
Android Phones
Google Phones
Motorola Phones
OnePlus Phones
Samsung Phones
Nothing Phone
TV Best Picks
TV Face-Offs
Audio Insights
Audio Best Picks
Audio Deals
Audio Face-Offs
Audio How-Tos
Audio Reviews
Over-Ear Headphones
Bluetooth Speakers
Smart Speakers
TV & Audio Brands
Entertainment
Streaming Devices
Prime Video
Paramount Plus
PlayStation
Handheld Gaming
Gaming Peripherals
Connections
Computing Insights
Computing Best Picks
Computing Deals
Computing Face-Offs
Computing How-Tos
Computing News
Computing Reviews
VPN Best Picks
VPN Face-Offs
VPN How-Tos
VPN Reviews
Operating Systems
Identity Theft Protection
Parental Controls
Malware & Adware
Virtual Reality
Augmented Reality
Smart Glasses
Chromebooks
Gaming Laptops
Apple Desktops
Gaming Desktops
Android Tablets
Computing Brands
AI Insights
AI Best Picks
AI Face-Offs
Google Gemini
Apple Intelligence
Mattress Best Picks
Mattress Deals
Mattress Face-Offs
Mattress How-Tos
Mattress News
Mattress Reviews
Mattress Care
Mattress Toppers
Pillows & Bedding
Smartwatches
Fitness Trackers
Smart Rings
Apple Watch
Home Insights
Home Best Picks
Home Face-Offs
Home How-Tos
Home Reviews
Home Topics
Home Appliances
Home Office
Home Security
Home Brands
Popular Brands
View Phones
Phone Insights
Phone Best Picks
Phone Deals
Phone Face-Offs
Phone How-Tos
Phone Reviews
Network Carriers
View Network Carriers
Android Phones
View Android Phones
Google Phones
Motorola Phones
OnePlus Phones
Samsung Phones
Nothing Phone
TV Best Picks
TV Face-Offs
Audio Insights
View Audio Insights
Audio Best Picks
Audio Deals
Audio Face-Offs
Audio How-Tos
Audio Reviews
Headphones
View Headphones
Over-Ear Headphones
View Speakers
Bluetooth Speakers
Smart Speakers
TV & Audio Brands
Entertainment
View Entertainment
View Streaming
Streaming Devices
Prime Video
Paramount Plus
View Gaming
PlayStation
Handheld Gaming
Gaming Peripherals
Word Games
Connections
View Computing
Computing Insights
Computing Best Picks
Computing Deals
Computing Face-Offs
Computing How-Tos
Computing News
Computing Reviews
VPN Best Picks
VPN Face-Offs
VPN How-Tos
VPN Reviews
View Hardware
View Software
Operating Systems
View Security
Identity Theft Protection
Parental Controls
Malware & Adware
View VR & AR
Virtual Reality
Augmented Reality
Smart Glasses
View Laptops
Chromebooks
Gaming Laptops
View Desktops
Apple Desktops
Gaming Desktops
View Tablets
Android Tablets
Computing Brands
AI Insights
AI Best Picks
AI Face-Offs
AI Engines
Google Gemini
Apple Intelligence
View Wellness
Mattresses
View Mattresses
Mattress Best Picks
Mattress Deals
Mattress Face-Offs
Mattress How-Tos
Mattress News
Mattress Reviews
Mattress Care
Mattress Toppers
Pillows & Bedding
View Fitness
Smartwatches
Fitness Trackers
Smart Rings
Apple Watch
Home Insights
Home Best Picks
Home Face-Offs
Home How-Tos
Home Reviews
Home Topics
Home Appliances
Home Office
Home Security
View Outdoors
Home Brands
Popular Brands
Exclusive Apple Interview
iPhone 17 Pro
Wordle Today
Best laptops
Best Mattress
Don’t miss these
Malware & Adware
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
Malware & Adware
More than 250 malicious apps are spreading info-stealing malware on Android and iOS — delete these right now
Malware & Adware
This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this
Malware & Adware
This Android malware poses as real apps to take you to dangerous sites and flood your phone with spam
Malware & Adware
This Android spyware is posing as an antivirus app to steal your photos and passwords — how to stay safe
Malware & Adware
This spyware is stealing photos on iPhone and Android — protect yourself now
Malware & Adware
200,000 passwords, credit card data and more stolen by this dangerous new malware — how to stay safe
Malware & Adware
12 signs your phone has been hacked — and what to do next
Malware & Adware
This new Android banking trojan can automatically transfer money off your phone to hackers
Online Security
7 online scams that can leave you broke, exposed, and feeling helpless — how to stay safe
Online Security
Millions hit in quishing attacks as malicious QR codes surge — how to stay safe
Online Security
Hackers are using fake TikTok Shops to steal money and spread malware — don’t fall for this
Online Security
Beware: Hackers are using fake credit card emails to steal all your passwords
Malware & Adware
Google wants to fight Android malware by making sideloading more difficult — here’s how
Online Security
Nearly 2 million people hit by malicious Chrome installations that can track you — what to do now
Online Security
Malware & Adware
Google just took down 224 malicious apps with 38 million installs from the Play Store — how to stay safe
Anthony Spadafora
17 September 2025
Massive adware campaign targeted Android devices in 228 countries
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
(Image credit: Marcos_Silva/Shutterstock)
Bad apps can be hiding in the place you least expect and that’s exactly what happened with 224 malicious apps that were recently removed from the Google Play Store following the discovery of a massive ad fraud campaign.
As reported by BleepingComputer, the campaign itself was discovered by Human’s Satori Threat Intelligence team which revealed in a new report that these apps had over 38 million downloads in total. However, it was the advanced tricks and obfuscation techniques they used to bypass Google’s defenses that really stood out.
Unlike previous ad fraud campaigns, this one spanned across the globe with users of the best Android phones downloading them from 228 countries, though they generated the most ad impressions in the U.S. (30%), India (10%) and Brazil (7%). Human’s security researchers have dubbed the campaign “SlopAds” as the malicious apps used in it had a mass produced look and feel, similar to online content created by AI image generators and other AI tools.
You may like
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
More than 250 malicious apps are spreading info-stealing malware on Android and iOS — delete these right now
This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this
Here’s everything you need to know about this new ad fraud campaign including what to do if you did download one of the apps in question along with some tips and tricks to help keep your Android phone safe from adware apps.
From legitimate to malicious in an instant
In order to avoid being detected by Google’s app review process and Android’s built-in security software, the scammers behind this new ad fraud campaign went to great lengths.
For instance, if an Android user installed one of these so-called SlopAd apps directly through the Play Store of their own accord, the app would act as it normally would once installed. However, if they stumbled upon one of these apps after clicking through from the scammers’ various ad campaigns, the app would become malicious after installation.
Once the SlopAds app ran the necessary checks to see whether or not it was installed via the Play Store, it would then download an encrypted configuration file that contained links to the scammers’ ad fraud malware module, cashout servers and a JavaScript payload. From there, the app would run one final check to make sure it was installed on a legitimate Android user’s device and not being analyzed by a researcher or software before proceeding.
Sign up to get the BEST of Tom’s Guide direct to your inbox.
Get instant access to breaking news, the hottest reviews, great deals and helpful tips.
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.
Now this is where things get interesting. These SlopAd apps would download four PNG images that look harmless at first glance. However, they actually use stenography to hide pieces of a malicious APK or installation file which is the driving force behind this ad fraud campaign.
After being downloaded, the images are decrypted and then reassembled on a targeted device to form the FatModule malware. Once activated, it uses hidden WebViews to collect device and browser information as well as to navigate to scammer-controlled domains which are used to cashout all of this fake ad revenue generated by these SlopAd apps.
The domains themselves impersonated videogame and news sites while continuously serving hidden WebView screens. This generated over two billion fraudulent ad impressions and clicks each day which brought in quite a lot of money for the scammers.
You may like
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
More than 250 malicious apps are spreading info-stealing malware on Android and iOS — delete these right now
This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this
How to stay safe from ad fraud apps
(Image credit: Google)
Although Human’s Satori Threat Intelligence team hasn’t released the full list of these 224 SlopAd apps, they’ve all been taken down from the Google Play Store. Likewise, if you accidentally downloaded one, you don’t need to worry about tracking it down on your own. This is because Google has updated Android’s built-in security app Google Play Protect to warn users to uninstall any of these malicious apps that may be on their smartphones or tablets.
So besides stealing, what’s so dangerous about ad fraud and adware apps? Well, imagine if your phone was constantly loading random websites in the background throughout the day? Not only would this eat up your mobile data but it would also put unnecessary strain on your phone’s battery and other components. As such, you’d probably need to upgrade to a new device sooner rather than later if you had one of these SlopAd apps or a similar adware app installed.
I know this isn’t as pressing of a threat as your typical Android malware infection, but it’s still something you need to be aware of and look out for. Even though we’re not dealing with an infostealer or other dangerous malware here, you can see above how those who chose to sideload these apps were much more at risk than others who downloaded them from an official Android app store, in this case, the Play Store itself.
If you are worried about malware and other viruses ending up on your phone or tablet, then you might want to consider running one of the best Android antivirus apps alongside Google Play Protect. Likewise, if you want the ultimate protection from hackers, scammers and even identity thieves, then the best identity theft protection services are what you’re after. They’re more expensive but a big reason for this is that they include identity theft insurance which can range from anywhere from $1 million to $2 million. This money can be used to cover legal expenses, to get new documents and to compensate you for any funds lost to fraud.
Given how much money a major ad fraud scheme like this one can generate for scammers and other cybercriminals, this likely isn’t the last one we’ll see. In fact, due to the sophistication of this SlopAds campaign, the security researchers who uncovered it believe that the scammers behind this one we’ll likely try something very similar quite soon. So be on the lookout and as always, be careful what you download.
Follow Tom’s Guide on Google News and add us as a preferred source to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button!
More from Tom’s Guide
Hackers are using Google search results to spread fake apps filled with malware — don’t fall for this
I found a phishing email in my inbox and a malicious app in my news feed — here’s how I knew they were scams
Fake Meta suspension warnings used in new malware campaign — how to protect your devices and your data
Today’s best Bitdefender Mobile Security deals
Bitdefender Mobile Security
at Bitdefender
See more Computing News
Google Play Store
Anthony Spadafora
Social Links Navigation
Managing Editor Security and Home Office
Anthony Spadafora is the managing editor for security and home office furniture at Tom’s Guide where he covers everything from data breaches to password managers and the best way to cover your whole home or business with Wi-Fi. He also reviews standing desks, office chairs and other home office accessories with a penchant for building desk setups. Before joining the team, Anthony wrote for ITProPortal while living in Korea and later for TechRadar Pro after moving back to the US. Based in Houston, Texas, when he’s not writing Anthony can be found tinkering with PCs and game consoles, managing cables and upgrading his smart home.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
More than 250 malicious apps are spreading info-stealing malware on Android and iOS — delete these right now
This dangerous banking trojan now uses scheduled maintenance to hide its malicious activities — don’t fall for this
This Android malware poses as real apps to take you to dangerous sites and flood your phone with spam
This Android spyware is posing as an antivirus app to steal your photos and passwords — how to stay safe
This spyware is stealing photos on iPhone and Android — protect yourself now
Latest in Malware & Adware
Fake Meta suspension warnings used in new malware campaign — how to protect your devices and your data
Hackers are using Google search results to spread fake apps filled with malware — don’t fall for this
This new Android banking trojan can automatically transfer money off your phone to hackers
Macs under attack from ‘cracked’ apps spreading dangerous info-stealing malware — don’t fall for this
Google wants to fight Android malware by making sideloading more difficult — here’s how
Dangerous Android banking trojan found lurking in malicious apps with 19 million installs — don’t fall for this
Latest in News
Google just took down 224 malicious apps with 38 million installs from the Play Store — how to stay safe
6 CarPlay upgrades arriving with iOS 26 — what you need to know
Bring your PS5 controller everywhere with the latest update — here’s what’s new
‘Matlock’ season 2 trailer teases more legal drama ahead for Kathy Bates
The Xbox PC app now gives you access to all your Windows games — launch titles from Steam, Epic Games and more
Roku just launched its first projector with a whopping 150-inch size — and it’s just $249
LATEST ARTICLES
6 CarPlay upgrades arriving with iOS 26 — what you need to know
Intermittent fasting turned me from a night owl to an early bird
Fake Meta suspension warnings used in new malware campaign — how to protect your devices and your data
Bring your PS5 controller everywhere with the latest update — here’s what’s new
‘Matlock’ season 2 trailer teases more legal drama ahead for Kathy Bates
Tom’s Guide is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
Terms and conditions
Contact Future’s experts
Privacy policy
Cookies policy
Accessibility Statement
Advertise with us
Future US, Inc. Full 7th Floor, 130 West 42nd Street,
Please login or signup to comment
Please wait…
