Integral Ad Science
  • Solutions
    BY PRODUCT TYPE
    Ad Fraud
    Brand Safety & Suitability
    Contextual Targeting
    Viewability
    Efficiency & Optimization
    BY CHANNEL
    CTV & Video
    Programmatic
    Proprietary Platforms
    Mobile & In-App
    Audio
    BY CUSTOMER TYPE
    Brands & Agencies
    Publishers
    Platforms & Partners
  • Insights
    IAS Insider
    Media Quality Report
    Research
  • Innovation
  • About
    Quality Impressions™
    Newsroom
    Leadership & Awards
    Careers
    ESG at IAS
  • Careers
Log in
Investor Relations
Contact
US US
UK UK DE DE ES ES FR FR IT IT JP JP BR BR LATAM LATAM APAC APAC Korean Korean
Integral Ad Science
  • Solutions
    BY PRODUCT TYPE
    Ad Fraud
    Brand Safety & Suitability
    Contextual Targeting
    Viewability
    Efficiency & Optimization
    BY CHANNEL
    CTV & Video
    Programmatic
    Proprietary Platforms
    Mobile & In-App
    Audio
    BY CUSTOMER TYPE
    Brands & Agencies
    Publishers
    Platforms & Partners
  • Insights
    IAS Insider
    Media Quality Report
    Research
  • Innovation
  • About
    Quality Impressions™
    Newsroom
    Leadership & Awards
    Careers
    ESG at IAS
  • Careers
Log in
Contact Us
US US
UK UK DE DE ES ES FR FR IT IT JP JP BR BR LATAM LATAM APAC APAC Korean Korean
  1. Home
  2. | Topics
  3. | Ad Fraud
  4. | IAS Threat Lab collaborates with Google to take down malicious app
May 15, 2023 by IAS Team

IAS Threat Lab collaborates with Google to take down malicious app

Ad Fraud
Featured
Insights
Mobile & In-App
Share:

By Nate Clark, Head of IAS Threat Lab

The digital landscape is prioritizing privacy now more than ever before. Internet users worldwide understandably want to ensure security when browsing the web. However, fraud can be found anywhere – even in apps that may identify themselves as safe.

The Scheme

The IAS Threat Lab recently uncovered an elaborate fraud scheme in a virtual private network (VPN) app targeting Android phones called Oko VPN. Developed by VIP Internet Security LTD., the app was labeled as a free VPN service that anonymizes a user’s web traffic and made available in the Google Play Store in July 2022. 

In reality, Oko VPN was hijacking IP addresses, turning users’ phones into fraud-relaying devices. Any Android phone that installed the app unwittingly donated its IP address for use by Oko VPN to commit ad fraud. The fraudsters exploited the user’s IP address to mask the origin of traffic to send fake ad impressions to video streaming platforms. This IP hijacking scheme is referred to as “residential proxying.” 

This app also posed a risk for illicit material/traffic going through users’ home networks, making it possible to make further attacks on users’ home networks – which emphasized the need to remove the app from the Google Play Store immediately.

The Takedown

Upon detecting the malicious app in March 2023, the IAS Threat Lab contacted the Google Play Store team who conducted their own investigation and confirmed the Threat Lab’s findings. After the Threat Lab identified the scheme, IAS notified Google, which immediately removed the app and enforced Google Play Protect, which warns users and prompts them to uninstall the malicious app.

The Impact

Oko VPN experienced exponential growth, with more than a million users at the time of its takedown. The Threat Lab team estimates that Oko VPN was generating approximately 100 million fraudulent impressions per month at the time of its removal from the Google Play Store. The team estimates that $10 million in advertiser spend was wasted on this scheme.

Fraud schemes like this are unfortunately quite common – and advertisers need to be aware. The IAS Threat Lab is constantly working to identify new and novel fraud schemes, protecting advertisers, publishers, and consumers from digital ad fraud. 

IAS established the Threat Lab to provide targeted reconnaissance of new and emerging fraud schemes. The team employs data analysis and reverse engineering to uncover fraud schemes and determine how they work, which allows the team to protect advertisers, publishers and consumers, by working with partners and authorities to take down the fraudsters.

For details on the scheme, download the Technical Disclosure: Oko VPN.
Access the content now.
Download
Access the case study now.
Download
Access the guide now.
Download
Access the research now.
Download
Sign up for insights right to your inbox.
Subscribe now ›

Related Posts

Diversity & Inclusion: Centering inclusivity in the future of digital marketing
Diversity & Inclusion: Centering inclusivity in…
Learn more ›

June 1, 2023 by IAS Teams

IAS earns industry’s first MRC accreditation for CTV Viewable Impressions
IAS earns industry’s first MRC accreditation…
Learn more ›

May 18, 2023 by IAS Teams

Mother’s and Father’s Day: Capitalizing on Context & Investigating Impact
Mother’s and Father’s Day: Capitalizing on…
Learn more ›

May 11, 2023 by IAS Teams

IAS white red logo
Sign up for fresh insights

Solutions

By Product Type

Ad Fraud

Brand Safety & Suitability

Contextual Targeting

Viewability

Efficiency & Optimization

By Channel

CTV & Video

Programmatic

Proprietary Platforms

Mobile & In-App

Audio

By Customer Type

Brands & Agencies

Publishers

Platforms & Partners

Insights

IAS Insider

Research

Media Quality Reports

About IAS

Quality Impressions™

Newsroom

Leadership & Awards

Careers

Helpful Links

Contact

Log in

© 2023 Integral Ad Science, Inc.

Accessibility_Icon Accessibility statement

Site indexing policy

Privacy policy

Subscription management

Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media

Site indexing policy

Privacy policy

Subscription management

Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media
Transparent Background - Social Media

© 2021 Integral Ad Science, Inc.

Search

Hit enter to search or ESC to close

Download Content

Fill out the form to have this content delivered directly to your email inbox.

Thanks for your interest. Fill out our contact form if you'd like more information.

Subscribe now

Fill out the form to sign up for the latest and greatest IAS updates— delivered right to your inbox.

Thank you for signing up for the IAS Newsletter.