Share on LinkedIn
Share on XRing. Ring. Ring.
Hear that?
In a classic horror movie, the twist is realizing the call is coming from inside the house.
In ad tech, the surprise can be just as unsettling: suspicious activity hiding inside familiar apps and everyday devices. A mobile app loads websites where no one is looking. A desktop app keeps serving ads after the screen is locked. A reading app generates clicks behind the story on screen.
In honor of spooky season, we’re rounding up three IAS Threat Lab findings that reveal what can lurk behind an ordinary-looking ad impression.
1. AI-generated disguises: Genisys
What’s scarier than hidden traffic? Hidden traffic with hundreds of websites ready to receive it.
In Inside Genisys: The 25-Million-Device Fraud Network Built with AI, IAS Threat Lab uncovered an operation that used everyday smartphones and tablets to load websites in the background, without users’ knowledge.
The traffic flowed through nearly 500 AI-generated domains posing as blogs, news sites, and other web properties. Genisys also used app bundle ID spoofing to obscure which apps were generating the activity. Across a network spanning 25 million devices, the operation generated hundreds of millions of bid requests.
The websites looked like destinations for readers. The readers, however, weren’t there.
2. The desktop app with a dark secret
Ad-supported desktop apps can be a valuable source of inventory. But what happens when an app keeps refreshing ads after it’s minimized—or even after the device is locked?
In Desktop App Supply Is Booming, Transparency Needs to Keep Pace, IAS Threat Lab examined how desktop apps represent and deliver ad inventory. While many implementations aligned ad behavior with user activity, the team also found cases where ads continued refreshing out of view.
Other findings included apps generating ad requests across multiple domains and modifying browser signals in ways that made app traffic look like ordinary web traffic. For buyers, those behaviors can make it harder to tell where an impression came from and whether anyone had a chance to see it.
If an ad renders on a locked screen in an empty room, does it make a sound? Maybe not. But it does raise questions about the impression.
3. The phantom reader: Papyrus
Someone opens a novel app and settles in to read. Behind the story, a hidden browser gets to work.
In Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention, IAS Threat Lab found reading apps secretly loading websites in the background. The scheme could also generate clicks and scrolling on pages the reader never chose to visit.
Those fabricated interactions made the traffic appear unusually engaging. In IAS’s analysis, Papyrus traffic showed a nearly 25-times-higher click success rate and attention scores about 13% higher than comparison traffic.
While people read stories in the app, Papyrus generated clicks and scrolls on websites they never saw. That’s phantom engagement advertisers could mistake for real interest.
Don’t let hidden threats haunt your campaigns
The scariest threats don’t always announce themselves. They can hide behind a familiar app, a legitimate-looking domain, or engagement metrics that seem too good to question.
Fortunately, you don’t need garlic or a wooden stake. You need a closer look at what’s behind your ad impressions. Reach out to your IAS representative to learn how IAS helps uncover invalid traffic before it haunts your campaign performance.
