The IAS Threat Lab published a new report revealing an extensive and sophisticated ad fraud scheme, called ‘Vapor Threat,’ which uses fake Android apps to implement infinite full-screen intrusive video ads.
This fraudulent operation, named Vapor, is so called due to its ability to ‘vaporize’ any real functionality of the apps, leaving behind only intrusive ads.
In total, the Threat Lab identified over 180 app IDs as part of the Vapor Threat scheme, which accumulated more than 56 million downloads and generated over 200 million ad bids daily since 2024, with no real functionality delivered to users.
The IAS Threat Lab shared the findings with Google, which subsequently removed all identified applications from the Google Play Store. However, the fraudsters behind the operation created multiple developer accounts, each hosting only a set of apps to distribute their operation and avoid detection. This distributed setup ensures that removing a single account has minimal impact on the overall operation.
To learn more about how the apps were designed to mimic legitimate applications, the impact of fraud on consumers and brands, the scale and timeline of the operation, and other details, the full report (in English) can be downloaded via this link.
For context, the IAS Threat Lab is a dedicated team of specialists focused on identifying and dismantling sophisticated fraud operations using malware analysis and reverse engineering to uncover emerging threats before they surface.
