Executive Summary

The IAS Threat Lab is a dedicated team within Integral Ad Science (IAS) focused on uncovering, dissecting, and mitigating sophisticated ad-fraud schemes and malicious digital-advertising behavior. The team’s latest discovery, Arcade, reveals a growing monetization pattern within the open web’s gaming ecosystem. A large cluster of HTML5 gaming domains, all active and fully functional, are monetizing their ad supply through hidden in-app browser activity sourced from fraudulent Android applications. These gaming domains receive real ad requests and deliver playable content, but the traffic itself never comes from visible users. Instead, it originates from background-rendered browser tabs embedded inside Android utilities and lightweight gaming apps.

The IAS Threat Lab identified 50 Android apps with a combined 10 million installs, collectively driving traffic to a network of more than 200 HTML5 gaming domains. The HTML5 games are legitimate and responsive, yet typically unseen by human users. IAS’s fraud detection systems identified unusual background rendering and domain iteration behavior, enabling early intervention before the campaign reached full scale.

An Invisible Arcade of Real Games

The domains at the heart of this scheme are deceptively authentic. Each hosts playable, browser-based games, complete with interactive interfaces and advertising frameworks. The domain names frequently contain gaming-related keywords such as “game” or “play” and appear innocuous to verification systems because the pages load correctly and function as intended. When traffic is reviewed on the surface, everything points to legitimate gaming engagement.

However, behind this facade, fraudulent Android apps continuously load these pages in invisible in-app browser tabs, generating a constant stream of ad impressions. The pages are not user-facing, and the activity occurs silently while the app performs unrelated tasks. One analyzed app cycled through hundreds of domains in sequence, creating persistent, automated inventory that appeared indistinguishable from genuine gameplay sessions.

How the Scheme Activates

Arcade’s activation framework builds on the same cloaking principles first disclosed by IAS in Mirage. In that earlier operation, apps concealed their ad fraud logic until certain install conditions were met, allowing them to appear legitimate in standard testing environments. Arcade applies this same approach.

When installed directly from app stores, Arcade-linked apps behave normally and show no signs of suspicious behavior. The ad fraud components only activate when the app identifies that it has been installed through a paid ad campaign or referral flow.

This determination is made using attribution SDKs (Appsflyer SDK), which reports the method of installation to the app. If the install is confirmed to be campaign-driven, the app communicates with a remote command-and-control server, transmitting device and referral data in custom headers. When these headers meet strict validation checks, the server responds with an encrypted payload, which the app decrypts and loads dynamically. The decrypted code enables hidden in-app browser tabs to render HTML5 gaming domains in the background and, in many cases, activates out-of-context ad delivery as a secondary monetization path

Because this payload is delivered only to targeted devices, the apps remain clean under normal review conditions. Many samples also include anti-analysis safeguards designed to detect virtualized or sandboxed environments and suspend execution, further complicating detection efforts.

Monetization at Two Levels

Once activated, apps under the Arcade cluster monetize through two distinct yet complementary mechanisms. The first is hidden traffic generation, which uses the network of gaming domains as a monetization endpoint. These domains serve as the true beneficiaries, selling inventory created by invisible sessions within the apps. The second is out-of-context advertising, a recurring behavior seen in earlier IAS investigations such as Vapor and Mirage, where apps run unexpected full-screen or interstitial ads appearing outside normal engagement flows.

This dual structure allows threat actors to extract revenue from both visible and invisible ad surfaces. While the visible ads frustrate users, the invisible gaming sessions serve as the far greater financial engine.

Distribution and Geographic Shifts

Arcade’s early activity was concentrated in Western markets, primarily the United States, Brazil, and Canada. Over time, the campaigns have migrated toward Asia-Pacific regions. By September 2025, installs and traffic were dominated by Turkey, Vietnam, the Philippines, Thailand, Indonesia, and Malaysia. These countries now comprise nearly half of all detected Arcade traffic, indicating a deliberate redirection of campaign targeting.

Among the identified apps, Street King Vacano (com.txt.streetking.vacano) a lightweight gaming app exemplifies Arcade’s scaling model. The app achieved top chart positions, including #1 Top New Free, in several markets and reached over 1 million installs in less than one month.

Detection and Outlook

Arcade is anything but subtle. The volume of traffic attributed to this operation points to a well-resourced and coordinated effort, capable of producing and maintaining a myriad of Android apps and gaming domains at industrial scale. The threat actors behind Arcade have invested heavily in development infrastructure, domain acquisition, and continuous app deployment, allowing them to sustain large amounts of fraudulent traffic that blend into the broader gaming ecosystem. 

IAS fraud detection systems identified the operation through a combination of behavioral anomaly analysis and domain traversal pattern recognition. Repeated, rapid page loads and non-interactive rendering events exposed the activity as non-human.

The ongoing investigation continues to map the infrastructure of developer accounts and associated domain operators behind the scheme. While the current set includes 200 gaming domains and 50 apps, the modular nature of Arcade’s framework suggests that new domains can easily be added as others are blocked.

Conclusion

Arcade demonstrates how legitimate web content can be reappropriated into a hidden monetization layer. The gaming domains themselves are central to this operation, earning revenue from traffic that no human ever generates. Android apps function as the traffic engine, quietly delivering ad requests that fund the ecosystem behind them.

By detecting and removing these apps and domains from the advertising supply chain, IAS effectively cuts off the operation’s financial lifeline, preventing further monetization and neutralizing the resources that fuel its continued growth.

IAS Threat Lab remains committed to uncovering and disrupting evolving monetization schemes before they reach advertisers’ budgets. Learn more about our AI-powered approach to combatting fraud pre- and post-bid.

The post Inside “Arcade,” the Gaming Web That Plays Itself appeared first on Integral Ad Science.

The post Media Quality Report: 20th Edition appeared first on Integral Ad Science.

The post How IAS is Fighting Back Against the Shape-Shifting Kaleidoscope Scheme appeared first on Integral Ad Science.

The post IAS’s Multi-Tiered Approach to Combating Ad Fraud appeared first on Integral Ad Science.

The post IAS Threat Lab Uncovers Extensive Fraud Scheme Leveraging Fake Android Apps appeared first on Integral Ad Science.

The post Ad Fraud in Digital Audio Streaming: What Marketers Need to Know appeared first on Integral Ad Science.

The post The 2025 Industry Pulse Report appeared first on Integral Ad Science.

The post Mastering Ad Verification: Viewability, Ad Fraud, and Brand Safety Measurement for Effective Campaigns appeared first on Integral Ad Science.

The post IAS Partners with OpenX to Provide AI-Driven Brand Safety, Suitability, and Invalid Traffic Measurement appeared first on Integral Ad Science.

A particularly insidious form of this practice is one click fraud, where a fraudulent system or bot executes a single but strategically placed invalid click to bypass detection mechanisms. Unlike large-scale bot-driven click fraud schemes, one click fraud is designed to evade standard fraud filters by mimicking natural user behavior, making it even more challenging for advertisers to detect and mitigate.

This malicious activity not only drains marketing budgets but also skews data, leading to misguided strategies and diminished return on investment (ROI). 

As digital advertising continues to grow, so does the sophistication of click fraud tactics, making it imperative for marketers to adopt advanced protection measures to safeguard their campaigns and ensure accurate performance evaluation.

What’s the true cost of ad click fraud?

The true cost of click fraud encompasses more than just financial losses. It disrupts the integrity of digital advertising by inflating click-through rates and misleading advertisers with false engagement metrics, ultimately diminishing the effectiveness of marketing campaigns. 

Click fraud undermines trust and credibility within the digital advertising ecosystem. It erodes the confidence of advertisers in online platforms and tarnishes the reputation of publishers and ad networks. Addressing click fraud is essential not only to safeguard advertising budgets but also to uphold transparency and maintain a sustainable environment where brands can effectively connect with their target audiences. 

The true cost of click fraud goes well beyond the financial implications: 

• Financial impact: Advertisers pay for each click on their ads, whether legitimate or fraudulent. Click fraud can drain advertising budgets rapidly, leading to wasted resources and reduced ROI.
• Sustainability efforts: Click fraud impedes efforts toward sustainable digital advertising practices by distorting performance metrics.
• Data integrity: Fraudulent clicks distort performance metrics such as click-through rates and conversion rates, making it difficult for marketers to accurately assess the success of their campaigns and make informed decisions.
• Trust and reputation: For publishers and ad networks, click fraud compromises trust with advertisers and can damage their reputation in the industry. It undermines the credibility of digital advertising platforms as effective channels for reaching target audiences.

Let’s dive deeper into click fraud’s serious implications and explore what marketers can do about it.

Financial impact of click fraud

Click fraud poses a substantial financial threat to brands and advertisers, significantly affecting their revenue streams and overall financial health. Increasing invalid traffic, primarily driven by click fraud, can have several detrimental effects:

1. Loss of ad spend: In 2024, it’s projected that advertisers and brands could lose as much as $71 billion due to invalid traffic generated by click fraud. This loss directly impacts advertising budgets, diminishing the effectiveness of marketing campaigns and reducing the ROI from digital advertising efforts.
2. Revenue dilution: Click fraud not only wastes advertising dollars but also dilutes the revenue potential for brands. The projected loss of up to $205 billion in revenue underscores the magnitude of the problem, as fraudulent clicks do not translate into genuine consumer engagement or sales conversions. This financial impact can hinder growth strategies and profitability targets for brands relying on digital advertising channels.

• Budget allocation challenges: Advertisers rely on accurate data to allocate their advertising budgets effectively. Click fraud distorts performance metrics, leading advertisers to make decisions based on misleading information. As a result, brands may misallocate resources, investing in channels that do not yield the expected returns due to fraudulent activities skewing engagement metrics.

The Growing Threat of Programmatic Fraud

As digital advertising continues to evolve, fraudsters are finding new ways to exploit automated systems. Programmatic fraud refers to fraudulent activities that occur within programmatic advertising, where ad inventory is bought and sold in real-time auctions.

This type of fraud includes tactics like domain spoofing, ad stacking, pixel stuffing, and bot-driven invalid traffic, all of which manipulate impressions, clicks, and engagement data to deceive advertisers. Since programmatic advertising relies on automation and AI-driven bidding, fraudsters exploit its complexity to siphon ad dollars while remaining undetected.

Programmatic fraud not only wastes ad spend but also distorts critical performance metrics, leading advertisers to make misinformed decisions about budget allocation and campaign effectiveness. Without proper fraud prevention measures, brands risk placing ads in low-quality or non-viewable environments, reducing the overall impact of their marketing efforts.

By integrating programmatic fraud detection tools into their ad strategies, marketers can better protect their investments and ensure that their ads are reaching real, engaged users in legitimate digital environments.

The hidden environmental costs of click fraud

Ad campaigns can be detrimental to the environment. 

Of the 3.8 million metric tons of carbon dioxide emissions generated annually by programmatic display advertising globally, 26.4% of impressions are estimated to be non-viewable, according to data from Lunio. This equates to approximately 1 million metric tons of carbon dioxide emitted yearly to serve non-viewable impressions.

This highlights a significant concern regarding carbon emissions from digital advertising. Given that campaigns often accumulate millions of impressions, each impression consumes enough energy to charge tens of thousands of smartphones.

Click fraud can impact sustainability efforts in a number of ways:

1. Energy consumption: Each fraudulent click triggers data processing and server activities, consuming energy resources. Data centers and servers require substantial energy to operate efficiently. The increased activity due to fraudulent clicks contributes to higher energy consumption, indirectly impacting carbon footprints and contributing to environmental degradation.
2. Electronic waste: The digital advertising ecosystem relies heavily on electronic devices and hardware. When click fraud artificially inflates advertising metrics, it can lead to increased demand for new electronic devices, contributing to electronic waste (e-waste) when older devices are discarded prematurely. E-waste management is a critical aspect of environmental sustainability, and minimizing unnecessary device turnover is essential.
3. Resource utilization: Fraudulent activities can lead to inefficient allocation of resources. Advertisers may misallocate budgets based on false data, directing investments away from genuinely effective channels. This inefficiency can lead to unnecessary consumption of resources like raw materials for advertising materials and human resources for managing ineffective campaigns.

By comprehending the carbon footprint of campaigns, marketers and brands can grasp the magnitude of their environmental impact. This awareness marks the initial stride towards eliminating inefficient practices within digital advertising.

Publishers and brands face significant reputational damage as a result of click fraud

One click fraud, though subtle, plays a role in tarnishing a brand’s image by wasting budgets and distorting campaign performance. Click fraud can cause significant reputational damage to both advertisers and publishers involved in online advertising. When click fraud occurs and advertisers unknowingly pay for fraudulent clicks, several reputational challenges can arise:

1. Wasted budget and ROI concerns: Advertisers rely on accurate data and performance metrics to assess the effectiveness of their advertising campaigns. If a significant portion of their budget is wasted on fraudulent clicks that do not generate genuine interest or conversions, it can lead to questions about the efficacy of their marketing strategies and the return on investment from online advertising.
2. Impact on trust and credibility: Advertisers may lose trust in the advertising platforms where the click fraud occurred. They may question the platform’s ability to protect their advertising investments and provide accurate reporting. This loss of trust can result in advertisers reducing their advertising spend on the platform or seeking alternative advertising channels, potentially damaging the platform’s reputation in the industry.
3. Legal and regulatory issues: In some cases, click fraud can lead to legal consequences, such as violating terms of service agreements with advertising platforms or facing legal action from affected parties. Legal disputes and negative publicity resulting from click fraud can further damage the reputation of the parties involved.
4. Publisher reputations at stake: Publishers hosting fraudulent clicks can also suffer reputational damage. Advertisers may exclude websites suspected of engaging in click fraud, reducing their ability to attract legitimate advertisers in the future. This tarnishes the publisher’s reputation within the advertising community and affects their revenue stream.

How IAS helps

Marketers seek transparency regarding the measures taken to safeguard their advertising investments on every platform. They desire comprehensive visibility into the detection and filtration of invalid traffic. Despite this, some marketers have yet to adopt dedicated systems for preventing invalid traffic, which underscores a critical opportunity for enhancing the efficiency of ad spend.

That is why IAS is teaming up with Lunio in a first-to-market partnership to provide post-click measurement and protection across search, social, and display networks. This partnership builds on IAS’s existing ad fraud detection and mitigation capabilities, giving marketers the most comprehensive IVT protection in the industry.

In partnership with Lunio, marketers can receive reliable, transparent post-click IVT analytics and traffic protection capabilities, with key benefits including:

• Transparency: Understand how IVT is affecting accounts and spot where junk visits are damaging campaign performance
• Empowerment: Proactively analyze and optimize paid media investments using insights from click data and traffic quality signals that aren’t available elsewhere
• Quality: Increase the quality of ad traffic by leveraging insights to prevent invalid and junk traffic from wasting resources and skewing data — for laser-focused targeting of real prospects

By safeguarding every stage of the ad journey against invalid traffic — from impressions through to click — advertisers can enhance transparency and ensure quality from beginning to end of each campaign.

TALK TO AN IAS REP

The post What Is Click Fraud? appeared first on Integral Ad Science.