Loading story…
DoubleVerify uncovered a sophisticated ad fraud operation known as the SkyWalk scheme, which embeds secret browsers within iOS gaming applications. This technique generates millions of fake ad impressions, allowing fraudsters to siphon advertising revenue while simultaneously draining the battery and resources of consumer devices. The scheme highlights the evolving tactics used by threat actors to exploit mobile advertising ecosystems and evade traditional detection mechanisms.
Security researchers warn that such hidden browser-based fraud not only impacts advertisers financially but also degrades user experience and device performance. The discovery underscores the need for enhanced monitoring and verification tools within mobile app environments to detect and mitigate similar fraudulent activities targeting the mobile advertising supply chain.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026
IAS Threat Lab reported that a mobile ad fraud operation dubbed **Papyrus** was embedded in Android novel-reading apps, where it secretly opened hidden browser views and generated ad traffic while users read serialized fiction. The scheme relied on a command-and-control orchestration layer called `BootNova`, which fetched remote configuration and instructed the apps which destinations to load, how many concealed WebViews to spawn, and how those views should behave. Researchers said Papyrus used components including `WebViewOut`, `CWebViewPlugin`, and an obfuscation module labeled `RsaUtils` to automate page loads, clicks, scrolling, ad closing, consent handling, and touch-copying without users' knowledge. IAS linked the operation to more than **800 domains** and nearly **8,000 unique hostnames**, and estimated the activity generated close to **$1 million per month** at its peak; the fraudulent traffic also showed unusually high click success rates, `eCPM`, and attention scores, potentially skewing advertisers' campaign optimization and budget decisions toward invalid supply.
Aug 17, 2026A large-scale ad fraud operation, dubbed SlopAds, leveraged 224 Android apps with over 38 million downloads to generate up to 2.3 billion fraudulent ad requests per day. The campaign used novel techniques including steganography, multi-layered code obfuscation, and conditional activation based on installation source to evade detection. Google has removed the identified apps and enhanced Play Protect to block similar threats, but researchers warn these sophisticated tactics are likely to reappear.
Jun 29, 2026