An In-Depth Look at Ad Fraud

Ad fraud causes enormous financial losses for companies and also affects the general public

In late 2025, Reuters revealed an internal Meta report in which the company estimated that 10% of its revenue from the previous year came from the publication of ads for scams and prohibited products. We’re talking about $16 billion. An earlier report by the U.S. company had concluded that Facebook, Instagram, and WhatsApp users were bombarded with some 15 billion fraudulent ads per day, and that the measures implemented to prevent this were insufficient. And we’re only referring to Meta’s ecosystem. We’re not even considering other widely used social media platforms like TikTok or X, search engines like Google or Bing, or e-commerce sites like Amazon or Temu.

Year after year, the criminal advertising fraud industry generates a massive amount of money. And we’re not just talking about the publication of fake ads for investment platforms, illegal online casinos, banned medical products, or fraudulent e-commerce sites. Many malicious actors focused on ad fraud enrich themselves by generating fake web traffic, racking up visits and clicks that aren’t driven by real people. To what end? To get paid for ad placements on websites that, in reality, aren’t visited by anyone.

As if this turbulent landscape weren’t already a cause for concern for the business ecosystem as a whole, AI is enhancing criminal groups’ ability to set up ad fraud operations, accelerating their design, preparation, and execution.

Below, we’ll provide an overview of ad fraud, ranging from the use of adware to the creation of botnets dedicated to ad fraud. We’ll also highlight the role that cyber intelligence plays in detecting and dismantling these malicious operations.

Adware: An unwanted program that bombards you with ads

A common element in futuristic dystopias is the sheer volume of advertisements that reach people from the most unexpected places. Cities become billboards displaying an endless stream of ads that plague not only public spaces but also homes. Adware is a category of PUP/PUA (Potentially Unwanted Program/Potentially Unwanted Application) that brings this dystopian vision into reality. We’re talking about a type of potentially unwanted program that, if it turns out to be malicious, would fall into the category of spyware.

Adware can be installed on an operating system, just like any other program, or as a malicious extension in the user’s browser. Its function is to bombard users with advertisements, without them being aware of where they’re coming from.

How does adware get onto a computer? Most commonly, users download free software or install browser extensions that generate revenue precisely by constantly displaying ads.

In early 2026, Microsoft announced the takedown of StegoAd, one of the most complex ad fraud campaigns detected to date, which consisted of 119 malicious extensions for Edge, the company’s web browser. These were very common types of extensions: ad blockers (yes, paradoxically), VPNs, translators, video downloaders, etc. In fact, the malicious actors managed to secure 2.6 million installations of their fraudulent extensions.

The extensions functioned correctly and only activated their malicious payload several days after installation, so as not to arouse suspicion. Furthermore, the malicious activity took place on two levels:

• The visible level was ad fraud. The extensions replaced Google AdSense and Amazon ads with their own ads and skimmed affiliate commissions from Amazon, eBay, or AliExpress.
• The hidden aspect involved the theft of credentials from infected browsers. As a result, the attackers were able to gain access to the Google or Microsoft accounts of 2.6 million users.

TV boxes and streaming platforms are also in the crosshairs of ad fraud

About $40 million a year. This is what the perpetrators behind Fuyao earned—a criminal business model that uses pre-installed apps on cheap TV boxes (devices that turn a regular TV into a smart TV) to build an ad fraud botnet, so that infected TV boxes can operate in two different modes depending on whether or not their owners are using their TVs:

• The ad fraud mode. The infected device browses websites controlled by the malicious actors, generating traffic and clicking on ads. The bots mimic the characteristics of mobile phones to bypass controls that prevent ads from being shown to users on other devices, since these users generate higher advertising revenue. Furthermore, they are able to successfully locate and interact with advertising content.
• The proxy mode. If the legitimate TV user has the TV Box connected, it functions as a proxy, forwarding third-party internet traffic through the home network. This allows the malicious actors to sell the infected home networks to others, generating a second source of revenue.

The Fuyao case is extraordinary due to the level of ambition displayed by the malicious actors. They created a company to design and market products that would allow them to orchestrate a massive ad fraud operation.

However, ad fraud campaigns related to the audiovisual sector do not stop there. In fact, one study estimates that there are 4 million infected devices acting as part of botnets to generate fake traffic on streaming platforms such as YouTube or Spotify to generate ad revenue, while simultaneously causing millions in losses for advertisers.

Malicious Mobile Apps That Drive Ad Fraud

In recent years, ad fraud targeting our mobile phones has grown significantly.

Malicious actors develop mobile apps capable of generating artificial traffic and clicks without the owners of infected devices realizing it.

For example, in August 2026, an ad fraud operation known as Papyrus was exposed; it uses multiple mobile novel-reading apps to surreptitiously generate web traffic from the browsers of the mobile devices on which they are installed.

Users can use the apps without detecting anything suspicious, but behind the scenes, the apps open malicious websites, scroll through them, click on links, and boost engagement metrics.

Papyrus has more than 800 domains and 8,000 unique hostnames, with most of its websites being gaming sites or blogs created using generative AI. Given the level of engagement they generate, the success rate of Papyrus’s artificial traffic is much higher than that of real traffic, making it appear more valuable. As a result, it is estimated that Papyrus may have earned as much as $1 million per month.

A few months earlier, Google had dismantled another ad fraud operation, Trapdoor, in which users downloaded seemingly uninfected apps such as PDF viewers. However, once installed, these apps would display pop-ups to convince phone owners to download other malicious apps capable of opening hidden WebViews, loading domains owned by the actors behind the operation, and requesting ads, thereby generating substantial profits.

Fake Ads on Social Media: Financial Fraud and Malvertising

As we noted at the beginning of this article, beyond generating artificial traffic and clicks, the malicious actors behind ad fraud also launch campaigns designed to scam users of social media platforms or search engines.

For example, one type of fraudulent ad that has become a plague on social media is sponsored content related to investment platforms and cryptocurrencies. In many cases, the cybercriminals behind these ads impersonate famous and successful public figures to deceive their victims and convince them to invest in financial products that, in reality, do not exist.

In fact, a U.S. court is set to hear a case between Andrew Forrest, a mining industry magnate, and Meta regarding this issue. Forrest, one of Australia’s wealthiest men, is suing Meta, arguing that the company is responsible for allowing ads on Facebook that impersonated him for years. Meanwhile, the U.S. company maintains that these fake ads were not its doing and, therefore, it is not liable.

But ads that conceal scams span multiple areas: from claiming subsidies to renting homes. Wherever criminals see fertile ground for victims to fall for their schemes and make fraudulent payments, they design campaigns to achieve that goal.

Alongside financial fraud, there are malvertising campaigns, which, as the name suggests, combine advertising fraud with the deployment of malware such as infostealers. What is the goal? To trick users into downloading infected programs and files. The goal is to take control of infected devices, spy on users, and obtain critical information such as passwords for accessing corporate software or online bank accounts.

The malicious use of AI is also fueling ad fraud

By now, no one doubts that AI is accelerating the offensive capabilities of malicious actors in areas such as detecting and exploiting vulnerabilities, designing malware, and executing attacks that adapt in real time to the responses orchestrated by their victims’ security teams.

When it comes to ad fraud, the use of AI allows malicious actors to:

• Develop websites to capture traffic and generate ad revenue more quickly and with fewer resources.
• Create extremely convincing deepfakes to produce scam ads.
• Build botnets that artificially generate traffic to their websites and content on social media and streaming platforms.
• Make the artificial traffic go unnoticed, thanks to bots that mimic the behavior of real users.
• Design adware without needing advanced technical knowledge.

It’s not all bad news—AI is also already being used by social media platforms and search engines to filter ads and detect potentially fraudulent content. For example, Google announced that it blocked or removed more than 8 billion ads in 2025, of which 600 million were scam-related ads. And all of this was made possible through the use of AI.

Similarly, AI enhances the ability to identify anomalous behavior in website traffic and detect fake websites created solely to generate advertising revenue.

Why is ad fraud attractive to malicious actors?

Ad fraud is a highly profitable and easy-to-monetize criminal business model that, moreover, targets the advertising market—a sector in which more than 900,000 million euros will be invested globally by 2026.

What can malicious actors do to get a piece of that pie?

• Earn huge amounts of money from ads displayed on their fake websites and apps or from ads viewed by replacing legitimate ads on e-commerce or streaming platforms.
• Earn money through referral programs from the world’s leading online retailers, such as Amazon or eBay.
• Steal cryptocurrency and trick victims into making fraudulent payments or providing credentials to take control of their bank accounts.
• Gain access to software that is vital to citizens and businesses and use the information obtained to sell it on the black market or commit financial fraud.

Ad fraud is a threat to citizens, but also to the business ecosystem

It is clear that constant exposure to fraudulent ads on social media and search engines increases users’ vulnerability. Furthermore, the use of our devices in botnets exposes us to other attacks and slows down the performance of the devices we use.

However, ad fraud is not only a threat to citizens and households; it also poses a major problem for:

• Social media platforms, search engines, large e-commerce sites, and streaming platforms. These are the entities that sell ad space and act as intermediaries between companies seeking to advertise and their potential customers. Ads are, after all, an indispensable source of revenue for social media platforms and search engines. If advertisers’ confidence in digital advertising declines, these platforms risk seeing their business models threatened.
• The digital advertising and marketing sector. If customers’ confidence in the effectiveness of advertising investments declines, organizations offering these services risk significant losses in clients and revenue.
• Large companies and public figures whose reputations are tarnished by identity theft carried out by malicious actors to deceive their victims.
• The business ecosystem as a whole. Attracting customers and generating sales through social media or search engines is one of the pillars on which the business strategies of all types of companies—not just large corporations—are based today. This is because, nowadays, small and medium-sized enterprises (SMEs) also invest in advertising on social media and search engines. Ad fraud causes their investments to lose value, given that their ads do not reach potential buyers but are instead shown to victims of adware or viewed by nonexistent users.

Cyber intelligence is critical to combating ad fraud

Given the damage that ad fraud causes to a wide range of stakeholders, how can we combat malicious campaigns? This is where cyber intelligence comes into play.

Cyber intelligence experts have extensive experience in investigating, analyzing, and preventing digital fraud, including audiovisual piracy, financial fraud, and ad fraud. As a result, they can:

• Continuously monitor the ad fraud ecosystem and understand the techniques, tactics, and procedures used by malicious actors in order to adapt to them.
• Detect ad fraud campaigns that impersonate key individuals or companies’ brand identities at an early stage.
• Help neutralize ad fraud activities to minimize their impact.
• Advise companies on implementing prevention and mitigation measures against ad fraud campaigns.
• Analyze lost profits and the financial and reputational damage caused by ad fraud campaigns.
• Conduct a strategic analysis of ad fraud trends to facilitate strategic decision-making by the parties involved.
• Support the legal strategy against cybercriminals who operate ad fraud campaigns.

Ultimately, ad fraud generates enormous profits for malicious actors and causes significant financial and reputational losses for companies that sell ads, digital marketing experts, businesses that invest in digital advertising, organizations and individuals whose identities are stolen by cybercriminals, and citizens who are affected by fraudulent ads or the unauthorized use of their devices.

For this reason, it is vitally important that all companies affected by ad fraud seek advice from cyber intelligence experts who understand the strategies and technologies employed by malicious actors and can devise plans to successfully combat them.