Ad fraud case files

How it worked. Software on phones, TV boxes and PCs quietly rented out the owners' home internet connections. Buyers of that access, including many criminal groups, could make their traffic look like ordinary households.

What happened. Google took legal action to seize dozens of control domains in January 2026 and updated Play Protect to remove apps with the proxy code; proxy numbers fell by about 40% within weeks.

The lesson. Residential IPs are for sale at scale; IP reputation alone cannot separate humans from bots.

How it worked. The malware sat inside a core part of the Android system on some devices, so it ran inside every app and could get around normal app permissions. It was used mainly to generate fraudulent ad activity and showed links to BADBOX and Triada.

What happened. Google removed three related smart-camera apps from Play and Play Protect now flags known versions.

The lesson. When fraud lives in firmware, app-level checks see nothing wrong; device provenance is part of ad quality.

How it worked. Harmless-looking PDF and clean-up apps showed misleading ads that pushed users to install further apps. Those apps opened hidden web views that requested ads, and switched on only for users acquired through the operators' campaigns.

What happened. Google removed all identified apps from Google Play after disclosure in May 2026.

The lesson. Malvertising and ad fraud feed each other: bad ads recruit the devices that then fake impressions.

How it worked. The apps were published as working tools, then updated to add harmful features. They hid themselves and showed full-screen video ads out of context, sometimes making the phone hard to use; some variants also tried to steal credentials.

What happened. Google removed all the identified apps from the Play Store.

The lesson. An app that was clean at review time may not be clean later; ongoing monitoring beats one-time vetting.

How it worked. Low-cost devices made in mainland China were sold with a hidden backdoor or picked one up through trojanized apps. Several cooperating groups used the devices to run hidden ads, click fraud and a residential proxy service.

What happened. Partners sinkholed domains and Google removed 24 apps (March 2025). The FBI issued a public warning in June 2025, and in July 2025 Google sued 25 unnamed operators in New York federal court and won a preliminary injunction.

The lesson. Cheap "free TV" boxes are a major source of CTV and residential-proxy fraud; buyers should demand device-level traffic quality signals.

How it worked. A clean version of each app sat on Google Play while look-alike versions distributed through third-party app stores bombarded users with intrusive ads. The fraudulent traffic borrowed the identity of the legitimate app.

What happened. IAS published the findings and shared indicators with the industry; the operation was linked to earlier campaigns.

The lesson. Where side-loading and third-party app stores are common, as in parts of India and Latin America, app-identity spoofing is a bigger risk.

How it worked. After installation the apps made their icons disappear so users could not easily find or remove them, then displayed ads outside of any app the user was actually using.

What happened. Google removed all the identified apps from Google Play.

The lesson. Out-of-context ads are both bad user experience and a fraud signal.

How it worked. The fraud code stayed dormant for normal downloads and switched on only for users who arrived via the operators' ad campaigns, which helped it hide from researchers. Hidden web views then generated ad traffic on sites the operators controlled.

What happened. Google removed all the apps from Google Play.

The lesson. Fraudsters now use attribution data to decide when to misbehave, so a clean test install proves little.

How it worked. The operators published innocent "decoy" apps on the official store and spread malicious twins of them elsewhere through malicious ads. The twins used the decoys' identities so their fraudulent ad traffic looked like it came from legitimate apps.

What happened. Google Play Protect detects and disables the twin apps; a new variant was reported in 2025.

The lesson. An app ID in a bid request is only a claim; the store listing can be clean while the traffic is not.

How it worked. The fraudsters bought legitimate ad slots inside apps, then used code hidden in their ad to secretly stack many video ad players behind one another. Each hidden player registered a paid view, while the user saw only one ad.

What happened. HUMAN disrupted the operation in mid-2022 through targeted blocking; traffic fell sharply and the scheme was reported shut down in January 2023.

The lesson. An ad creative can itself be an attack; buyers and sellers need creative scanning and ad stacking detection.

How it worked. Malware was added to cheap phones somewhere in the manufacturing or supply chain. Among other things it showed unwanted ads, committed click fraud and rented out the phone's internet connection as a residential proxy.

What happened. Trend Micro presented the research at Black Hat Asia 2023; the infrastructure overlapped with later BADBOX findings.

The lesson. Some fraud begins in the factory, which makes device and supply-chain provenance part of traffic quality.

How it worked. Cheap, uncertified Android TV boxes and tablets shipped with a hidden backdoor. The infected devices, together with look-alike apps, generated hidden ad traffic, served as residential proxies and created fake accounts.

What happened. HUMAN worked with Google and Apple to disrupt it. In December 2024 Germany's BSI cut off at least 30,000 infected devices in Germany by sinkholing the operators' servers.

The lesson. Traffic from real homes and real TV boxes can still be fraudulent; hardware provenance matters in CTV fraud.

How it worked. The apps pretended to be other popular apps so ad systems would pay higher prices, and loaded ads off-screen where nobody could see them. It was the third wave of a scheme that began in 2019.

What happened. Google and Apple removed the apps after HUMAN reported them.

The lesson. Fraud operations come back in new versions; takedowns are ongoing work, not a one-off.

How it worked. The apps imitated a user's taps to click ads from major mobile ad networks, so advertisers paid for clicks no person made.

What happened. Google removed all the apps from Google Play.

The lesson. Apps aimed at children are a frequent target, which also raises COPPA concerns for advertisers.

How it worked. Malicious Android apps made phones send ad requests that claimed to come from TV-streaming devices watching popular channels. Because CTV ads cost far more than mobile ads, faking the device type multiplied the payout.

What happened. White Ops disrupted the operation in 2020 with Roku and Google; Google removed the apps. It became a key example in industry calls for stronger CTV supply-chain checks such as app-ads.txt.

The lesson. CTV's high prices make it the most profitable place to fake; check device claims, not just the app name.

How it worked. According to Facebook's lawsuit, the developers' apps generated fake clicks on Facebook ads shown on users' phones, making it look as though the users had clicked and earning payouts for installs and clicks they did not drive.

What happened. Facebook banned the developers from its ad network in March 2019, refunded advertisers and sued in August 2019; Google suspended the developers' Play accounts.

The lesson. Platforms increasingly use lawsuits, not only blocklists, to deter fraud.

How it worked. Apps on Google Play promised free goods such as shoes or coupons. After installation they ran a hidden browser in the background that loaded ads and generated fraudulent impressions from real consumer devices.

What happened. White Ops shared its findings with Google, which removed the apps and updated Play Protect.

The lesson. Fraud on real devices defeats simple datacenter filtering; behaviour-based fraud detection is needed.

How it worked. App-install ads pay whichever partner "caused" the install. The implicated apps watched for new app downloads on the phone and fired a last-second fake click, so they got credit and payment for installs they did not drive.

What happened. Google investigated and removed some of the apps from Play and its ad networks; the companies disputed parts of the findings. The case pushed MMPs to add click-injection filters.

The lesson. In attribution, "last click wins" rewards whoever clicks last, not whoever persuaded the user.

How it worked. Three linked operations combined rented servers and malware on real people's computers (Kovter and Boaxxe) to load ads invisibly on counterfeit websites posing as real publishers. The mix of datacenter and residential traffic made it hard to spot.

What happened. In November 2018 the US Justice Department unsealed a 13-count indictment against eight people; the FBI seized 31 domains and 89 servers. Aleksandr Zhukov was convicted and sentenced to 10 years in 2021.

The lesson. Large frauds are only dismantled when platforms, verification firms and law enforcement share data; the case also showed buyers why ads.txt matters.

How it worked. Harmless-looking games on Google Play later received instructions from a remote server to open hidden web pages on the phone and click ads there. The phone owner saw nothing while the fraudsters collected ad revenue.

What happened. Google removed the apps after Check Point reported them.

The lesson. Clicks can come from real phones owned by real people who never saw the ad; device reputation alone is not enough.

How it worked. Malware on ordinary home computers quietly loaded web pages in the background. The traffic was labelled as coming from well-known publishers' domains, so buyers thought they were paying for premium placements.

What happened. Adform published its findings and shared them with the industry; the case was widely cited as a reason to adopt ads.txt, launched the same year.

The lesson. Residential IP addresses do not guarantee a human; the device itself can be hijacked.

How it worked. The operators ran automated browsers on servers in data centres and registered IP addresses so they looked like US home internet users. Those bots "watched" video ads on fake pages dressed up as famous publishers, faking mouse movements and logins to look human.

What happened. White Ops published the IP and domain lists so buyers could block them. Methbot's operators were later charged in the 3ve indictments, and ringleader Aleksandr Zhukov was sentenced to 10 years in US prison in 2021.

The lesson. An impression that claims to be from a premium site is not proof it was; verify the seller with ads.txt and filter data center traffic.