Trapdoor Android Ad Fraud Operation Uses 455 Malicious Apps to Generate Fake Clicks

Cybersecuritynews •Tushar Subhra Dutta • May 20, 2026

A large-scale ad fraud operation called Trapdoor has been discovered targeting Android users through 455 malicious apps, quietly generating fake ad clicks and draining real advertising budgets across the digital ecosystem. At its peak, the operation produced 659 million fraudulent bid requests in a single day and accumulated well over 24 million downloads on affected […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Surge in Android Banking Trojans: Four Campaigns Identified Zimperium's zLabs has reported a significant increase in Android Banking Trojan activity, identifying four distinct campaigns: RecruitRat, SaferRat, Astrinox, and Massiv. These campaigns utilize advanced Command-and-Control (C2) frameworks to steal credentials, execute unauthorized financial transactions, and exfiltrate data from over 800 applications in banking, cryptocurrency, and social media sectors. The trojans employ sophisticated anti-analysis techniques and APK tampering, achieving near-zero detection rates against traditional security measures. Attackers exploit human psychology through deceptive tactics, such as fake system updates and enticing offers, to gain initial access. The malware's distribution methods vary, with SaferRat using phishing websites for fake streaming services and RecruitRat masquerading as legitimate job opportunities. The threat landscape for mobile banking has evolved, necessitating heightened vigilance from users and security professionals alike. 113 sources 70

Trapdoor Android Ad Fraud Operation Uses 455 Malicious Apps to Generate Fake Clicks

The full story

Extracted Entities

Attack Types (1)

Platforms (2)