Papyrus Ad Fraud Scheme Uses Novel Apps to Generate Fake Traffic
A sophisticated ad fraud scheme named Papyrus is leveraging seemingly innocuous novel-reading apps to generate fake ad traffic by simulating user interactions in hidden browser windows.
A newly identified mobile ad fraud scheme, dubbed Papyrus, is employing a network of novel-reading applications to surreptitiously generate fraudulent advertising traffic. Researchers at IAS Threat Lab have uncovered that these apps, while presenting users with a reading interface for romance or fantasy stories, secretly load websites in hidden browser windows. These hidden browsers then simulate user activity, including clicking and scrolling, to inflate ad revenue through deceptive means.
The core of the Papyrus scheme is an orchestration layer called BootNova. This component controls the hidden browser activity within the app. Upon execution, BootNova communicates with remote command-and-control (C2) infrastructure to receive configuration instructions. The C2 server dictates crucial parameters such as whether the hidden activity should run, its timing, geographic targeting, retry behavior, the number of active webviews, and the specific interactions to be performed on loaded pages. This dynamic control allows operators to adjust the scheme's behavior without requiring app updates.
Once BootNova receives its instructions, it delegates the task of managing the unseen browser windows to worker modules known as WebViewOut. A wrapper component, CWebViewPlugin, ensures these windows remain attached to the app's interface, positioning them discreetly behind the visible content. In some instances, an additional cover view is layered on top, further obscuring the background activity from the user.
BootNova also employs measures to conceal its own communications. A module identified as RsaUtils decodes the hardcoded C2 address and the messages exchanged with the server using a combination of Base64 encoding and a character-shifting cipher. This obfuscation prevents the C2 address from being easily discovered through static analysis of the application.
Papyrus automates the interaction within these hidden browser windows through multiple mechanisms. Some applications include built-in JavaScript that can track user taps on the visible screen and replay them as synthetic touches, clicks, or scrolls in the background. Additionally, operators can push JavaScript from their C2 servers at runtime, enabling them to alter the hidden browser's actions on any given page dynamically. IAS observed server-delivered JavaScript capable of muting media elements and automatically clicking consent dialogs, streamlining the fraudulent process.
A third layer of automation involves "click and scroll modules" that capture user taps on the visible reading screen and pass them into the hidden webviews, registering them as clicks. The scheme utilizes "movement recipes" to define precise click coordinates, scroll ranges, delays between actions, ad-closing coordinates, and navigation behaviors. These recipes are selected probabilistically, ensuring the automated behavior varies and avoids predictable patterns.
Novel-reading apps were strategically chosen for this scheme due to their ability to retain user engagement for extended periods, unlike utility apps. This extended user session time provides a larger window for the hidden web monetization activities. The visible app experience serves as a cover, while the background browser activity drives the monetization path.
IAS has linked the Papyrus scheme to over 800 domains and nearly 8,000 hostnames, predominantly comprising gaming sites, blogs, news-style pages, and AI-generated content designed to absorb traffic. The fraudulent traffic generated by Papyrus exhibited significantly higher click success rates and attention scores compared to legitimate traffic, leading IAS to estimate that the scheme generated close to $1 million per month at its peak. This sophisticated operation not only wastes advertising spend but also distorts performance reporting, potentially leading advertisers to invest more in fraudulent traffic.