{"id":349306,"date":"2026-08-26T13:14:15","date_gmt":"2026-08-26T13:14:15","guid":{"rendered":"https:\/\/integralads.com\/?p=349306"},"modified":"2026-08-26T13:14:17","modified_gmt":"2026-08-26T13:14:17","slug":"papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention","status":"publish","type":"post","link":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/","title":{"rendered":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention"},"content":{"rendered":"\n<h4 id=\"h-executive-summary\" class=\"wp-block-heading\">Executive Summary<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">IAS Threat Lab has identified a new mobile ad fraud scheme, Papyrus, involving a cluster of novel-reading applications that monetise users\u2019 reading sessions by running hidden browser activity in the background. While users believe they are simply reading a story, the apps are secretly using their phone to visit websites, generate clicks, and create fake engagement behind the scenes. The apps present themselves as entertainment products built around long-form fiction and serialised stories, but IAS observed them covertly navigating to web domains under the direction of command-and-control infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Sample novel-reading apps associated with Papyrus:<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"454\" height=\"314\" src=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-1.png\" alt=\"\" class=\"wp-image-349307\" srcset=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-1.png 454w, https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-1-300x207.png 300w\" sizes=\"(max-width: 454px) 100vw, 454px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The choice of novel-reading apps is central to the scheme\u2019s monetisation model. Unlike utility apps that users may open briefly to complete a task, reading apps are designed for longer, continuous sessions. Those extended sessions create more opportunity for background browser activity to navigate across monetised web properties, allowing the scheme to generate traffic while the user remains engaged with visible in-app content.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus is anchored by an extensive network of web properties built to receive traffic from the associated apps. IAS has identified<strong>\u00a0more than 800 domains\u00a0and\u00a0nearly 8,000 unique host values\u00a0<\/strong>associated with the scheme. These destinations are largely composed of gaming, blog, news-style, and GenAI-created content domains, reflecting the continued use of synthetic web properties built for monetisation rather than real audiences.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Sample Papyrus domains used to receive and monetise hidden browser traffic:<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"454\" height=\"138\" src=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-2.png\" alt=\"\" class=\"wp-image-349318\" srcset=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-2.png 454w, https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-2-300x91.png 300w\" sizes=\"(max-width: 454px) 100vw, 454px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">What makes Papyrus especially concerning is that it goes beyond hidden traffic generation and actively manipulates the metrics buyers rely on. The apps use click and scroll modules that pass user taps into hidden webviews, registering clicks in the background. They also receive instructions to scroll pages, inflating attention signals and making the traffic appear more valuable to buyers. That risk showed up clearly in IAS analysis:&nbsp;Papyrus traffic had a nearly 25x higher click success rate, roughly 4x higher eCPM, and about 13% higher attention scores than non-Papyrus traffic. In other words, the fraudulent traffic wasn\u2019t just fake, it appeared more valuable than legitimate traffic. That makes the impact of the metrics immediately obvious. Based on observed eCPM rates and broader supply visibility, IAS estimates that Papyrus may have generated&nbsp;close to $1 million per month&nbsp;in monetisation impact at its peak.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus shows that hidden browser fraud is not limited to a single mobile environment. Schemes that pair legitimate-looking app experiences with covert monetisation can emerge wherever fraud operators find the right combination of user attention, embedded browser capabilities, and monetisable web destinations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS clients using IVT avoidance are already protected against Papyrus. IAS Threat Lab identified the scheme, and the associated apps, domains, and hostnames are being filtered as invalid traffic across both avoidance and measurement.<\/p>\n\n\n\n<h4 id=\"h-i-technical-deep-dive\" class=\"wp-block-heading\">I. Technical Deep Dive<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">How Papyrus Works<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus is built around&nbsp;BootNova, an orchestration layer that controls hidden browser activity inside the app.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When the app runs, BootNova contacts remote command-and-control infrastructure for configuration. The C2 can determine whether the hidden activity should run, where it should run, which URLs should be loaded, how many webviews should be active, and how those webviews should interact with loaded pages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This remote configuration can control enablement, timing, geographic targeting, retry behaviour, the number of webviews to run, destination URLs, and the interaction logic applied to those pages.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"454\" height=\"149\" src=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-3.png\" alt=\"\" class=\"wp-image-349329\" srcset=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-3.png 454w, https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-3-300x98.png 300w\" sizes=\"(max-width: 454px) 100vw, 454px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once BootNova receives instructions, it creates and manages hidden webviews through workers called&nbsp;WebViewOut. These webviews load the destinations provided by the C2 while remaining out of normal user view.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The outbound webviews are concealed primarily through native view layering. A custom wrapper,&nbsp;CWebViewPlugin, allows the webview to remain attached to the view hierarchy while sitting behind the visible app interface. The app can also use a cover view to further obscure the outbound webview without removing it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"454\" height=\"131\" src=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-4.png\" alt=\"\" class=\"wp-image-349340\" srcset=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-4.png 454w, https:\/\/integralads.com\/wp-content\/uploads\/2026\/08\/Papyrus-4-300x87.png 300w\" sizes=\"(max-width: 454px) 100vw, 454px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The effect is simple but powerful: the app can continue showing the expected reading interface while hidden webviews load and interact with web content in the background.<\/p>\n\n\n\n<h5 id=\"h-embedded-and-remote-controlled-automation\" class=\"wp-block-heading\">Embedded and Remote-Controlled Automation<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus uses both embedded and server-delivered JavaScript to automate webview behaviour.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The embedded JavaScript can instrument pages, capture click coordinates, and support synthetic touch, click, and scroll activity. The C2 can also deliver JavaScript at runtime, allowing the operator to adjust page-level behaviour without updating the app.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS observed server-delivered JavaScript that can mute media elements and automatically click page elements such as consent dialogs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This remote-control model gives Papyrus flexibility. The native app manages the hidden webview lifecycle, while the C2 can change destinations, interaction logic, and page-level behaviour dynamically.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">BootNova also uses obfuscation to make C2 communication less immediately visible during analysis. The module labelled&nbsp;RsaUtils&nbsp;decodes the hardcoded C2 URL and messages exchanged with the server using Base64 and indexed character shifting.<\/p>\n\n\n\n<h4 id=\"h-ii-the-threat-landscape\" class=\"wp-block-heading\">II. The Threat Landscape<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus\u2019s app category is not incidental. Novel-reading apps are designed for extended user sessions. A user may spend several minutes, or much longer, reading serialised content inside the app.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Long reading sessions create more opportunity for the scheme to operate. While the user is focused on visible reading content, the app can use background webviews to load remote websites, navigate across monetised destinations, and perform automated interactions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In other words, Papyrus converts time spent reading into time available for hidden web monetisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the core of the scheme: the visible app experience supplies the cover, while hidden browser activity supplies the monetisation path.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Bigger Risk: Manipulated Performance and Attention Signals<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus does more than create hidden traffic. It also manipulates the signals buyers may use to understand whether traffic is valuable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS observed click and scroll behaviour controlled through remote configuration. The scheme uses \u201cmovement recipes\u201d that can define click coordinates, scroll ranges, delays between actions, ad-close coordinates, and navigation behaviour. These recipes are selected through probability gates, allowing the behaviour to vary rather than repeat in a simple fixed pattern.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This matters because clicks, scrolling, and time spent with content can influence how performance and attention are interpreted. If those interactions are happening inside hidden webviews, the resulting signals may not represent genuine user intent or engagement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For advertisers, this is the more serious implication. Papyrus is not only generating hidden traffic; it is also attempting to make that traffic look more valuable by fabricating interaction signals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That changes the risk profile. A hidden page load can create invalid traffic. A hidden page load combined with automated clicks and scrolling can distort performance reporting and attention-based evaluation, leading to misinformed campaign optimisation strategies.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The click and scroll behaviour is supported by a mix of embedded app logic and server-delivered scripts.<\/p>\n\n\n\n<h4 id=\"h-iii-how-advertisers-can-safeguard-against-papyrus\" class=\"wp-block-heading\">III. How Advertisers Can Safeguard Against Papyrus<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">What This Means for Advertisers \u2014 and How IAS Helps Protect Them<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A user may really be spending time inside a reading app. A web property may really receive traffic from a mobile environment. A page may really register scrolls or clicks. But in Papyrus, those signals are connected through hidden webviews and remote automation, not through a normal path from user intent to web engagement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That distinction matters because Papyrus traffic appeared valuable on the surface. In IAS analysis,&nbsp;Papyrus traffic showed a nearly 25x higher click success rate, roughly 4x higher eCPM, and about 13% higher attention scores&nbsp;compared with non-Papyrus traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS estimated the potential monthly impact by combining two views of Papyrus activity. First, IAS used the portion of Papyrus supply it directly observed to calculate the scheme\u2019s eCPM. IAS then used broader supply-path data to estimate a larger view of Papyrus impression volume. Applying the observed Papyrus eCPM to that broader impression footprint indicates the scheme may have generated close to $1 million per month at its peak.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For advertisers, the risk is not only wasted spend on hidden traffic. It is the possibility that fabricated engagement can influence optimisation, reporting, and trust in media quality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS clients using IVT avoidance are already protected against Papyrus. IAS Threat Lab identified the scheme, and the associated apps, domains, and hostnames are being filtered as invalid traffic across both avoidance and measurement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By filtering the associated apps, domains, and hostnames, IAS helps keep Papyrus-associated supply out of protected campaigns and prevents the activity from being counted as valid engagement in measurement. This helps reduce the risk that automated clicks, hidden webview traffic, or inflated attention signals influence campaign delivery, optimisation, or reporting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus demonstrates why IVT protection must connect signals across the full chain: the app environment, hidden webview behaviour, destination domains, hostnames, and the automated clicks and scrolling used to make synthetic engagement appear real.<\/p>\n\n\n\n<h4 id=\"h-iv-methodology\" class=\"wp-block-heading\">IV. Methodology<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">IAS confirmed this behaviour during analysis by identifying a server-controlled test mode in the WebViewOut worker. When enabled, this mode brought the normally hidden webview forward, allowing researchers to observe automated scrolling, clicking, consent-form interaction, and the relationship between the visible reading interface and the hidden webview layers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This confirmed that Papyrus\u2019s hidden browser activity could run beneath the normal app interface while the user remained focused on the visible reading experience.<\/p>\n\n\n\n<h4 id=\"h-conclusion\" class=\"wp-block-heading\">Conclusion<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Papyrus shows how a legitimate-looking mobile app experience can be used to generate hidden web traffic and fabricate signals that make that traffic appear valuable. By combining BootNova-driven C2 instructions, hidden webviews, and automated clicks and scrolling, the scheme attempts to turn long reading sessions into monetisable web activity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IAS has identified more than 800 domains and nearly 8,000 unique host values associated with Papyrus. IAS Threat Lab will continue tracking the scheme as it evolves, while IAS IVT avoidance filters associated apps, domains, and hostnames as invalid traffic across avoidance and measurement.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Executive Summary IAS Threat Lab has identified a new mobile ad fraud scheme, Papyrus, involving a cluster of novel-reading applications that monetise users\u2019 reading sessions by running hidden browser activity in the background. While users believe they are simply reading&#8230;<\/p>\n","protected":false},"author":66,"featured_media":348937,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[295,287,282,836],"tags":[],"class_list":["post-349306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ad-fraud-uk","category-featured-uk","category-mobile-in-app-uk","category-threat-lab-uk"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.7 (Yoast SEO v28.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention - Integral Ad Science<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention\" \/>\n<meta property=\"og:description\" content=\"Executive Summary IAS Threat Lab has identified a new mobile ad fraud scheme, Papyrus, involving a cluster of novel-reading applications that monetise users\u2019 reading sessions by running hidden browser activity in the background. While users believe they are simply reading...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/\" \/>\n<meta property=\"og:site_name\" content=\"Integral Ad Science\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-26T13:14:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-26T13:14:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"860\" \/>\n\t<meta property=\"og:image:height\" content=\"860\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"VANESSA GRENIER\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@integralads\" \/>\n<meta name=\"twitter:site\" content=\"@integralads\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"VANESSA GRENIER\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/\"},\"author\":{\"name\":\"VANESSA GRENIER\",\"@id\":\"https:\\\/\\\/integralads.com\\\/#\\\/schema\\\/person\\\/d91a2fc9b8c61a7f44dbe68619105c42\"},\"headline\":\"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention\",\"datePublished\":\"2026-08-26T13:14:15+00:00\",\"dateModified\":\"2026-08-26T13:14:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/\"},\"wordCount\":1600,\"publisher\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Papyrus-Threat-Lab-Insider-1.png\",\"articleSection\":[\"Ad Fraud\",\"Featured\",\"Mobile &amp; In-App\",\"Threat Lab\"],\"inLanguage\":\"en-gb\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/\",\"url\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/\",\"name\":\"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention - Integral Ad Science\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Papyrus-Threat-Lab-Insider-1.png\",\"datePublished\":\"2026-08-26T13:14:15+00:00\",\"dateModified\":\"2026-08-26T13:14:17+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#breadcrumb\"},\"inLanguage\":\"en-gb\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-gb\",\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#primaryimage\",\"url\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Papyrus-Threat-Lab-Insider-1.png\",\"contentUrl\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/Papyrus-Threat-Lab-Insider-1.png\",\"width\":860,\"height\":860},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/integralads.com\\\/uk\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/integralads.com\\\/#website\",\"url\":\"https:\\\/\\\/integralads.com\\\/\",\"name\":\"Integral Ad Science\",\"description\":\"The Hidden Cost of MFA Webinar\",\"publisher\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/integralads.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-gb\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/integralads.com\\\/#organization\",\"name\":\"Integral Ad Science\",\"url\":\"https:\\\/\\\/integralads.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-gb\",\"@id\":\"https:\\\/\\\/integralads.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/IAS_Square-Logo-600x600-1.png\",\"contentUrl\":\"https:\\\/\\\/integralads.com\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/IAS_Square-Logo-600x600-1.png\",\"width\":600,\"height\":600,\"caption\":\"Integral Ad Science\"},\"image\":{\"@id\":\"https:\\\/\\\/integralads.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/integralads\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/integralads.com\\\/#\\\/schema\\\/person\\\/d91a2fc9b8c61a7f44dbe68619105c42\",\"name\":\"VANESSA GRENIER\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-gb\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g\",\"caption\":\"VANESSA GRENIER\"},\"url\":\"https:\\\/\\\/integralads.com\\\/uk\\\/insider\\\/author\\\/vgrenierintegralads-com\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention - Integral Ad Science","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/","og_locale":"en_US","og_type":"article","og_title":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention","og_description":"Executive Summary IAS Threat Lab has identified a new mobile ad fraud scheme, Papyrus, involving a cluster of novel-reading applications that monetise users\u2019 reading sessions by running hidden browser activity in the background. While users believe they are simply reading...","og_url":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/","og_site_name":"Integral Ad Science","article_published_time":"2026-08-26T13:14:15+00:00","article_modified_time":"2026-08-26T13:14:17+00:00","og_image":[{"width":860,"height":860,"url":"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png","type":"image\/png"}],"author":"VANESSA GRENIER","twitter_card":"summary_large_image","twitter_creator":"@integralads","twitter_site":"@integralads","twitter_misc":{"Written by":"VANESSA GRENIER","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#article","isPartOf":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/"},"author":{"name":"VANESSA GRENIER","@id":"https:\/\/integralads.com\/#\/schema\/person\/d91a2fc9b8c61a7f44dbe68619105c42"},"headline":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention","datePublished":"2026-08-26T13:14:15+00:00","dateModified":"2026-08-26T13:14:17+00:00","mainEntityOfPage":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/"},"wordCount":1600,"publisher":{"@id":"https:\/\/integralads.com\/#organization"},"image":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#primaryimage"},"thumbnailUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png","articleSection":["Ad Fraud","Featured","Mobile &amp; In-App","Threat Lab"],"inLanguage":"en-gb"},{"@type":"WebPage","@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/","url":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/","name":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention - Integral Ad Science","isPartOf":{"@id":"https:\/\/integralads.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#primaryimage"},"image":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#primaryimage"},"thumbnailUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png","datePublished":"2026-08-26T13:14:15+00:00","dateModified":"2026-08-26T13:14:17+00:00","breadcrumb":{"@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#breadcrumb"},"inLanguage":"en-gb","potentialAction":[{"@type":"ReadAction","target":["https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/"]}]},{"@type":"ImageObject","inLanguage":"en-gb","@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#primaryimage","url":"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png","contentUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2026\/07\/Papyrus-Threat-Lab-Insider-1.png","width":860,"height":860},{"@type":"BreadcrumbList","@id":"https:\/\/integralads.com\/uk\/insider\/papyrus-inside-a-mobile-scheme-built-to-fake-clicks-scrolls-and-attention\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/integralads.com\/uk\/"},{"@type":"ListItem","position":2,"name":"Papyrus: Inside a Mobile Scheme Built to Fake Clicks, Scrolls, and Attention"}]},{"@type":"WebSite","@id":"https:\/\/integralads.com\/#website","url":"https:\/\/integralads.com\/","name":"Integral Ad Science","description":"The Hidden Cost of MFA Webinar","publisher":{"@id":"https:\/\/integralads.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/integralads.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-gb"},{"@type":"Organization","@id":"https:\/\/integralads.com\/#organization","name":"Integral Ad Science","url":"https:\/\/integralads.com\/","logo":{"@type":"ImageObject","inLanguage":"en-gb","@id":"https:\/\/integralads.com\/#\/schema\/logo\/image\/","url":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png","contentUrl":"https:\/\/integralads.com\/wp-content\/uploads\/2023\/10\/IAS_Square-Logo-600x600-1.png","width":600,"height":600,"caption":"Integral Ad Science"},"image":{"@id":"https:\/\/integralads.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/integralads"]},{"@type":"Person","@id":"https:\/\/integralads.com\/#\/schema\/person\/d91a2fc9b8c61a7f44dbe68619105c42","name":"VANESSA GRENIER","image":{"@type":"ImageObject","inLanguage":"en-gb","@id":"https:\/\/secure.gravatar.com\/avatar\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/325e71ce4964ba30bd44e4094be5d1587e6825a53dbdd6d4579f118578623c91?s=96&d=mm&r=g","caption":"VANESSA GRENIER"},"url":"https:\/\/integralads.com\/uk\/insider\/author\/vgrenierintegralads-com\/"}]}},"_links":{"self":[{"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/posts\/349306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/users\/66"}],"replies":[{"embeddable":true,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/comments?post=349306"}],"version-history":[{"count":2,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/posts\/349306\/revisions"}],"predecessor-version":[{"id":349352,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/posts\/349306\/revisions\/349352"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/media\/348937"}],"wp:attachment":[{"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/media?parent=349306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/categories?post=349306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/integralads.com\/uk\/wp-json\/wp\/v2\/tags?post=349306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}