Google has launched a large-scale cleanup operation on its Play Store, removing over 180 apps linked to an “extensive and sophisticated ad fraud scheme.” These fraudulent apps, which collectively amassed more than 56 million downloads, were tricking advertisers into paying for fake user engagement while bombarding real users with excessive ads. Despite Google's efforts to fix the issue with security patches, the problem persisted, forcing the company to take the drastic step of deleting the affected apps.

How the Ad Fraud Worked

Unlike traditional malware that takes control of a user’s device, ad fraud schemes operate differently. Fraudsters create fake apps – often mimicking legitimate ones like QR code scanners or flashlight apps – and place them in popular Play Store categories. Unsuspecting users download these apps only to be flooded with intrusive ads.
Some of these apps also employ deceptive tactics to stay hidden. According to reports, many do not display an icon or an "open" button, making it difficult for users to identify and uninstall them. In some cases, they continue running in the background with a persistent notification, ensuring they remain active even when users try to close them. Impact on Users and Developers

This fraudulent scheme affected not only users but also advertisers and genuine app developers. Advertisers ended up paying for ad impressions that never reached real users, while developers who depend on ad revenue suffered financial losses. The presence of such fraudulent apps also undermined trust in the Play Store, potentially pushing users to seek alternatives outside Google's platform.
Even more concerning is that these apps managed to bypass Google Play Protect, the security feature designed to prevent harmful apps from infiltrating devices. This highlights a loophole in Android’s security system, which Google is now working to strengthen.

Google’s Response and Next Steps

To tackle the issue, Google collaborated with Integral Ad Science (IAS), a digital ad verification agency, to detect and remove fraudulent apps. IAS worked closely with industry partners to investigate the operation and minimise its impact. As a result, Google has now deleted all identified fraudulent apps from the Play Store.
Additionally, Google has promised to take proactive measures to prevent similar incidents in the future. The company stated that Google Play Protect will now automatically detect and disable these fraudulent apps – even if they are downloaded from third-party sources outside the Play Store.