Trapdoor Android Ad Fraud Operation Uses 455 Malicious Apps to Generate Fake Clicks

Trapdoor is a sophisticated, large-scale Android ad-fraud campaign in which 455 apps (collectively downloaded over 24 million times) install secondary payloads that open hidden browser windows and simulate human touch gestures to generate fake ad clicks; researchers observed up to 659 million fraudulent bid requests in a single day. The operation uses selective activation (triggered only for paid installs), code packing, string encryption, anti-analysis checks, and impersonation of legitimate SDKs to evade detection, and researchers published IoCs including bundled files (move.txt, click.txt), C2 domains, a malicious app list, and an /api/referrer endpoint.