Integral Ad Science bundled three 2026 Threat Lab investigations into a single Halloween roundup on October 21. It added no new research, but the comparison it invites is useful: ad fraud is getting better at mimicking your best-performing traffic, not just stealing impressions.
Papyrus: fraud that looks like a great reader
The standout case is Papyrus. IAS says reading apps ran a hidden browser behind the novel-reading experience, loading websites the user never chose to visit. The hidden traffic also generated clicks and scrolls. In IAS’s comparison, Papyrus traffic recorded a click success rate nearly 25 times higher than comparison traffic and attention scores about 13% higher.
That inverts the usual fraud assumption. Invalid traffic is often expected to underperform. Papyrus overperformed, which means buyers optimizing toward clicks or attention could have shifted budget toward fabricated engagement.
The same disguise, three costumes
The other two cases follow the same logic. Genisys, first reported in February, allegedly used smartphones and tablets to load ad-heavy sites in the background. Traffic flowed through nearly 500 AI-generated domains, according to IAS, while spoofed app bundle IDs hid which apps were really generating activity. The roundup repeats the headline figure of 25 million devices, though the underlying report does not show the counting method.
A May report on desktop apps found out-of-view ad refreshing: some apps kept ads running after being minimized or locked. IAS also described apps requesting ads across multiple domains and rewriting browser signals so app traffic looked like ordinary web traffic.
What the recap leaves out
The Halloween post is a sales reminder, not a fresh disclosure. Some of the most important numbers from the original reports are missing:
- Papyrus spanned more than 800 domains and nearly 8,000 unique host values.
- IAS estimated roughly $1 million a month in monetization impact for Papyrus at its peak.
- Papyrus eCPM ran about four times higher than comparison traffic.
- For Genisys, Google Play Protect acted and bid request volume dropped more than 95% for a representative set of apps, IAS said.
Those omissions change how buyers read the risk. The Genisys apps, on IAS’s own account, were largely shut down months ago. The Papyrus money figure and eCPM premium show what fabricated engagement costs advertisers; the roundup’s 25x click stat only shows how the fraud was dressed up.
What to do before the next budget shift
The practical lesson for performance teams is to treat abnormal engagement as a risk signal, not proof of quality. If one app, domain or supply path posts click or attention rates far above your account baseline, quarantine it and ask your verification partner for the method, sample size and comparison set.
IAS’s own takeaway from the roundup is a decent check: “The scariest threats don’t always announce themselves,” the post says. They can hide behind a familiar app, a plausible domain, or engagement metrics that seem too good to question.
Source: PPC Land
