Back Gbhackers

Trapdoor Android Ad Fraud Ring Abuses 455 Apps for Fake Clicks

Gbhackers •Mayura Kathir • May 20, 2026

A large-scale Android ad fraud campaign named “Trapdoor,” exposing a sophisticated ecosystem built on 455 malicious apps and 183 command-and-control (C2) domains. The operation combines malvertising, automated click fraud, and advanced evasion techniques to create a self-sustaining revenue loop that has generated massive fraudulent traffic across the digital advertising ecosystem. At its peak, Trapdoor generated […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Surge in Android Banking Trojans: Four Campaigns Identified Zimperium's zLabs has reported a significant increase in Android Banking Trojan activity, identifying four distinct campaigns: RecruitRat, SaferRat, Astrinox, and Massiv. These campaigns utilize advanced Command-and-Control (C2) frameworks to steal credentials, execute unauthorized financial transactions, and exfiltrate data from over 800 applications in banking, cryptocurrency, and social media sectors. The trojans employ sophisticated anti-analysis techniques and APK tampering, achieving near-zero detection rates against traditional security measures. Attackers exploit human psychology through deceptive tactics, such as fake system updates and enticing offers, to gain initial access. The malware's distribution methods vary, with SaferRat using phishing websites for fake streaming services and RecruitRat masquerading as legitimate job opportunities. The threat landscape for mobile banking has evolved, necessitating heightened vigilance from users and security professionals alike. 113 sources 70

Extracted Entities

Trapdoor Android Ad Fraud Ring Abuses 455 Apps for Fake Clicks

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (1)

Platforms (2)