<img src="https://ml.globenewswire.com/Resource/Download/2623335f-ba0d-4f90-97cb-b9c66b0de4b8?size=2" nborder="0" align="left" hspace="5" vspace="5" title="HUMAN_logo_horiz_black.jpg" alt="HUMAN Security, Inc"/>Self-sustaining fraud cycle drove 24 million downloads of malicious Android apps, connecting to threat actor–controlled HTML5 domains to fuel large-scale ad fraud<div style="float:right;padding:0 0 15px 20px;margin:15px 0 20px 20px;width:300px">
 HUMAN's Satori Researchers Identify and Disrupt Multi-Layered Ad Fraud and Malvertising Scheme Named Trapdoor
 <figure>
 <img src="https://ml.globenewswire.com/Resource/Download/6791f387-0756-480d-b635-b2530635c8ef" title="HUMAN's Satori Researchers Identify and Disrupt Multi-Layered Ad Fraud and Malvertising Scheme Named Trapdoor" alt="HUMAN's Satori Researchers Identify and Disrupt Multi-Layered Ad Fraud and Malvertising Scheme Named Trapdoor" />
 <figcaption>HUMAN's Satori Researchers Identify and Disrupt Multi-Layered Ad Fraud and Malvertising Scheme Named Trapdoor</figcaption>
 </figure>
</div>NEW YORK, May 19, 2026 (GLOBE NEWSWIRE) -- <a href="https://www.globenewswire.com/Tracker?data=mY-VZyVsMIdhjxRb9IYtFiNEdg66YPx7tNFxZfkYLYsrlXxH8pIGit7_oTkGD79x27x9WeBdublh1i7z_BOXLlcOR6A7r3QW80nn7h1D8IolKQ-vopMezzunDIZN1MJaqfJCjMWO8OxxQdvGjJn1AmS2cd_DIkPd_u7tzS1NEpzslyRdU1KaNr0sbr621jbBi-P0kOfDdwsy7Jz_I_aw9fClnRombPEPBNrHPSSKLUYhbXKwUCKbDIEM4WJa-5ds" rel="nofollow" target="_blank" title="">HUMAN Security, Inc.,</a> the trust layer for digital customer experiences in the agentic era, today announced that its <a href="https://www.globenewswire.com/Tracker?data=SN7vuBCRs-__JgVWo_vTjT9yxn1S1ChppQfsnsIrlWZSWaTdcfzi1Vw7ywNXJCEM1KkK1d8aECA5F6jo5wkAPSYBjpFiRtivyYg9oZk50x3L4Avq6Gl4Me3kqPlwURR9DYgQXFOxaRQH-bD4Q5tFmRPXQA5UN_1JN9byPCFlEHxZMQOGJkcEdQoUBtD-hhIvEpTAU8hPKkfCeJX9Wsk6Ven0pOpB_I-s-evN3mXpDfVVW3xIF-m6VqUnDmhphHKybNGWZhfP9SQC7ULURhA4ig==" rel="nofollow" target="_blank" title="">Satori</a> Threat Intelligence and Research Team has identified and disrupted a fast-growing ad fraud and malvertising operation dubbed <a href="https://www.globenewswire.com/Tracker?data=iYNu3xEa_SL5n7Vbdzp6FXwuKnYpJT5FJ6cHu5WsBjK4C28hm3h7UCHQRspt6MZbfhkf9B8UqxrnareryhXJg-p5LwKSFjCtC_562RTSJei_tXQerg_EaN2vgxDmtzCmQM3wVc5_po1jbSnscDn-n6ghHPOT0-SOg93pGfmbHh_BlDstiWsCJJyCPP1UJAta9G6n9mxBXXYiyZCaUpLAS143IcphdpRXfLFdeWi3sOajqS-Eo_rpVcPBMZNQlNhKOqzXoHD1Wv9P2TewdsohgZjahPJITR_tEciA1EOsIwoDBnDI-9ecHTWA0uyTYlykUqEUwYIm9EKDt4XEt4a53EzqH7tSC0KpNh-cYujx49g=" rel="nofollow" target="_blank" title="">Trapdoor</a>. The scheme gets its name because it functions like a hidden entryway to other areas—in this case, by fusing malvertising distribution with hidden ad-fraud monetization to create a pipeline in which each stage fuels the next. In this way, Trapdoor is essentially a self-sustaining cycle and multi-stage pipeline of fraud, encompassing 455 malicious Android apps and 183 threat-actor-owned HTML5 domains. Malicious apps triggered malvertising campaigns that use marketing attribution software to determine whether to download additional malicious apps, which then perform ad fraud using extensive obfuscation and anti-analysis techniques. Google removed all of the identified malicious apps from Google Play and Google Play Protect automatically safeguards users from apps known to conduct Trapdoor associated behavior. At its peak, Trapdoor accounted for 480 million bid requests a day, with associated apps downloaded more than 24 million times. “Trapdoor shows how determined fraudsters turn everyday app installs into a self-funding pipeline for malvertising and ad fraud,” said Gavin Reid, CISO at HUMAN. “This is another instance of threat actors co-opting legitimate tools—such as attribution software—to aid in their fraud campaigns and help them evade detection. By chaining together utility apps, HTML5 cashout domains, and selective activation techniques that hide from researchers, these actors are constantly evolving, and our Satori team is committed to tracking and disrupting them at scale.” The Trapdoor operation involves these steps: ● Users unwittingly download a threat actor-owned app, often a utility-style app such as a PDF viewer or device-cleanup tool. The apps themselves do not trigger fraud. ● These apps trigger malvertising campaigns that coerce users to download additional threat-actor-owned apps via ads claiming the app is out of date. Only apps downloaded via malvertising campaigns commit fraud, according to a mobile attribution platform. ● The secondary apps perform automated touch fraud, launch hidden WebViews, load threat-actor-owned HTML5 domains, and request ads. ● This cycle generates revenue that can fund further malvertising campaigns. The use of HTML5 cashout domains as the monetization layer connects Trapdoor to a broader pattern observed by Satori researchers: the SlopAds, Low5, and BADBOX 2.0 operations all used HTML5 game and news domains as cashout mechanisms. Trapdoor also involves abuse of marketing attribution tools, similar to the SlopAds investigation. “Trapdoor is a reminder that threats to the digital advertising ecosystem do not neatly fall into single categories,” said Lindsay Kaye, Vice President of Threat Intelligence at HUMAN. “This operation uses real, everyday software and multiple obfuscation and anti-analysis techniques—such as impersonating legitimate SDKs to blend in—to help fuse malvertising distribution, hidden ad fraud monetization, and multi-stage malware distribution. HUMAN will continue to monitor these emerging cyber threat tactics.” Researchers have shared the full list of Trapdoor-associated apps and domains with Google, and customers partnering with HUMAN for <a href="https://www.globenewswire.com/Tracker?data=AShMxYR3eYElgvWDCL0GiDj64DiyEJbbgcEDzPFP4uzuuBDeSJDMSNYAk6UAsxLxvWUnASiKfX9bbxHJVWSW2hr1T7ikRHcpXocVU53Ko4oQlBqfK542DNkaK4Nzh1dtxediRWgHm-YWTt5HMfCUZRN24_Nzmsdx1R6FDLciJFdQ-TOjrN-_rBsbOm24iyPvWdzDx60x4pcospAnKec8p7IOWWWFAdK0nEgsPCZD2KY0OdQKYV8jHwwChc5TjBNuE7tA5tLUrThGo1J4jFwRKPSz7XvUHnHxOoBobc_tAjg=" rel="nofollow" target="_blank" title="">Ad Fraud Defense</a> and <a href="https://www.globenewswire.com/Tracker?data=PgBNTFpHTQ_qhNtE0Ui_MaIBtlzJqFWGyoFBeF3xHVSR0vnBkJ-bb40Qgzy08l_IvmYx62xbgEUKEfDZpWdxpF0mOGrM5RCnnZxjpfgjtDXTTfmuYodx5qiSKM8TE3LCn58tbjK6IlULOQE0_KkCzyqR9iMLY9X4LsrfL4TXuocaFXWcLpBlqJhkho5Va45t4LkMJqu3oE2HZ4gb4YhRSRbJVW6Q3jzTNv3OrIS3zrbrG-STorgGeYnEW9rlYSylxAPTimlPzwQs2VPzE8Co28MBml4eBa1UC-iv9dW6pzI=" rel="nofollow" target="_blank" title="">Ad Click Defense</a> remain protected from Trapdoor. Satori researchers will continue monitoring the threat actors for new adaptations. About HUMAN: HUMAN Security is the global leader in Agentic Trust, the emerging discipline that informs and governs how humans, bots, and AI agents operate online. For more than a decade, HUMAN has specialized in understanding and mitigating automated traffic risk at internet scale, protecting the world’s largest brands, advertising platforms, and commerce networks. Today, HUMAN helps enterprises, platforms, and digital ecosystems verify digital interactions and establish trust across the entire customer journey - from first ad impression to final transaction. Powered by one of the world’s largest behavioral signal networks, HUMAN analyzes over a quadrillion digital interactions each year to distinguish legitimate activity from fraud, abuse, and automated manipulation. HUMAN delivers a unified trust layer for the agentic era — bridging security, marketing, and media with shared visibility, governance, and confidence in a world where humans and AI agents operate side by side. Learn more at <a href="https://www.globenewswire.com/Tracker?data=lbZktnMYV5NKIgFg5aNVn3XuSX-exsD4Pe09oWepUp-LoR5fWNrVUVvaRhwEI-Pp3pVssJ_NWbccz_pbPSeO2kSYJYKVwTzxkvVFuMaG11CUsepmsnAQTCSB6pc9iZEYPZboJeCr1kVidOLy8hOkAOQ1mCgvSiXgDmpi8OAfnA6W1Wl6-M5K16hkh7ra3EqpRvvd7V0tLbja4CHfeBgmnJSnAlCz7igveQvite1I-HY=" rel="nofollow" target="_blank" title="">humansecurity.com</a> Contact information: Masha Krylova, Director of Communications <a href="https://www.globenewswire.com/Tracker?data=O-P_Wn4eDEmAtQgtk73lz1zzC8AKPjcPBB8x5YxH_tzKYjrnoIg6vZaLnsFmHMOCTyawqEj1hyMoI4qDTPKEw_2VsowfFhWUNtvBgwMHIn7Rwu7n0SupxOoZDU8Kutt4" rel="nofollow" target="_blank" title="press@humansecurity.com">press@humansecurity.com</a> A photo accompanying this announcement is available at <a href="https://www.globenewswire.com/Tracker?data=Elly3ORPzCuly9HlFEgJf9_OQ_MaVPhH_ZNWQ4sMbAsqlScm3ighfuPeUqYYE24UrWN0sDMGRbuoEsPmgish9e3_DGz1pXebQD0M5aMVjJeUmUneFXgMuD9ns9ck0H38-vOw-YC_g7zf2tqw_S9zY0kl7hana-XkjsYZMVcjON6rEb-O09w2rHNORpnIl4e3HV3QCopxubcYJ2Kj5bT16omYUiekc6wIVrPGAr3CGEZGRDUbArX9kwn5JbUoG_gS1064uRMgZZ1isZQgXXhuvA==" rel="nofollow" target="_blank" title="">https://www.globenewswire.com/NewsRoom/AttachmentNg/6791f387-0756-480d-b635-b2530635c8ef</a> <img alt="" src='https://ml.globenewswire.com/media/YmI0ZjkyZjEtYmNiMi00NTVhLWIyZWYtYjcxOGJjYWUyYmE5LTUwMDEyMzI3My0yMDI2LTA1LTE5LWVu/tiny/HUMAN-Security-Inc.png' referrerpolicy='no-referrer-when-downgrade' />

GlobeNewswire Inc.

HUMAN’s Satori Researchers Identify and Disrupt Multi-Layered Ad Fraud and Malvertising Scheme Named Trapdoor

Latest news from the world of business and finance – both local and global

MONEY FM 89.3 is Singapore's first and only Business and Personal Finance station, featuring local and international business and financial news.

MONEY FM 89.3

Discover newsletters from our DJs on LinkedIn