Arcade’s activation framework builds on the same cloaking principles first disclosed by IAS in Mirage. In that earlier operation, apps concealed their ad fraud logic until certain install conditions were met, allowing them to appear legitimate in standard testing environments. Arcade applies this same approach.

When installed directly from app stores, Arcade-linked apps behave normally and show no signs of suspicious behavior. The ad fraud components only activate when the app identifies that it has been installed through a paid ad campaign or referral flow.

This determination is made using attribution SDKs (Appsflyer SDK), which reports the method of installation to the app. If the install is confirmed to be campaign-driven, the app communicates with a remote command-and-control server, transmitting device and referral data in custom headers. When these headers meet strict validation checks, the server responds with an encrypted payload, which the app decrypts and loads dynamically. The decrypted code enables hidden in-app browser tabs to render HTML5 gaming domains in the background and, in many cases, activates out-of-context ad delivery as a secondary monetization path

Because this payload is delivered only to targeted devices, the apps remain clean under normal review conditions. Many samples also include anti-analysis safeguards designed to detect virtualized or sandboxed environments and suspend execution, further complicating detection efforts.