A research post published on July 13, 2026 by DoubleVerify engineers describes a class of Android applications that wait for a phone call to finish and then take over the screen with an advertisement, a pattern the company has named AfterCall ads and says accounts for hundreds of millions of impressions each month.

The disclosure came through the DoubleVerify Engineering publication on Medium, in a post written by Nir Danon and filed under cybersecurity and Android development. It runs to roughly seven minutes of reading time and sets out, in unusual technical detail for a vendor blog, how a small set of Android platform features can be chained together to produce advertising that appears entirely outside the application that serves it.

The behaviour described is not new in category. Out-of-context advertising, meaning ads that surface when the host application is not in the foreground, has been a stated enforcement priority for app stores for years. What the DV Fraud Lab documents is a specific and currently effective delivery mechanism, and a set of evasion techniques that make the responsible application difficult for a user to identify.

The scenario the post opens with

Danon frames the finding through a household example: a phone that appears to be infected, where an advertisement for a game, a shopping service or an unrelated application appears every time a call ends. Checking the recent applications list, scanning for suspicious installations and reviewing browsing and download history turns up nothing. The advertisements continue.

That opacity is the point. According to the post, the DV Fraud Lab observed a significant spike in out-of-context applications using this mechanism, and the mechanism itself is described as simple rather than sophisticated.

Three components, all of them ordinary

Every AfterCall application the lab analysed follows a similar structure, according to DoubleVerify. The flow consists of three parts: a special permission obtained from the user under false pretences, a Broadcast Receiver that handles end-of-call events, and an Activity that renders the advertisement. None of these is a vulnerability. All three are documented Android features working as designed.

The permission that makes it possible

The pivot is SYSTEM_ALERT_WINDOW, exposed to users as the "Display over other apps" setting. Android treats this permission differently from ordinary runtime permissions. It cannot be granted through the standard in-application dialogue; the developer has to redirect the user into the Settings application, a deliberate friction intended to make the decision more considered.

Fraudulent developers work around that safeguard by manipulating the sequence in which permissions are requested, according to DoubleVerify. On first launch the application asks for permissions, which is standard behaviour. AfterCall applications, the post states, attempt to deceive the user into granting overlay access by claiming a legitimate reason for it. Danon writes that fraudsters rely on the oldest tricks in the book, namely "deception, and the user's lack of knowledge", and that "most non-technical users simply tap through, unaware of the consequences."

Two patterns were illustrated. In the first, the onboarding screen presents a plausible justification for the permission, one that may even be technically true, while the permission is subsequently abused for a different purpose. In the second, the application blocks its own interface until overlay permission is granted, which functions as a coercion mechanism rather than a request.

Hooking the end of the call

Android applications communicate across process boundaries using Intents and Broadcast Receivers, a publish and subscribe arrangement in which any application can opt in to receive a system message. When a call arrives, the TelephonyManager component broadcasts an ACTION_PHONE_STATE_CHANGED Intent with the state set to RINGING. A music application listening for that Intent pauses playback so the ringtone is audible. When the call ends, the same broadcast fires with the state set to IDLE, and playback resumes.

AfterCall applications register their own BroadcastReceiver for those same telephony Intents, according to the post, and use the IDLE signal as the trigger to display an advertisement.

The manifest declaration DoubleVerify reproduced contains several details worth noting. The receiver sets its priority to 998, an unusually high value, which the post suggests is intended to ensure it runs first when multiple receivers are listening to the same broadcast. Alongside PHONE_STATE, the receiver also registers for device startup, application updates and power connection events. Each of those keeps the application resident in memory, which raises the number of end-of-call events it can capture.

The same declaration contains an error: a permissions declaration placed inside an intent-filter tag, where it does not belong. Danon writes that "such errors reflect how low-quality these apps usually are", a judgement the post extends to the visual design of the advertising screens themselves.

The screen the user actually sees

The Activity that opens after the call carries a consistent layout across applications that are otherwise unrelated to one another, according to DoubleVerify: call details, a facade explaining how the screen supposedly relates to the application's stated function, a profile picture, and an advertisement placed underneath.

Two evasion techniques sit in that Activity. The first is removal from the recent applications list once the advertisement is displayed, which severs the trail a user would follow to identify the culprit. The post links that directly to commercial outcome: fewer uninstalls, and therefore more revenue. The second is icon selection. Where the application icon appears in the corner of the advertising screen, developers choose designs resembling everyday utilities such as a clock, a notes application or a calendar, which reads as harmless to a non-technical user.

Why the pattern resists standard detection

DoubleVerify sets out three reasons the trend is difficult to catch.

Static signatures fail because there is no shared codebase. "A static signature, such as matching a package name or class name, is ineffective since each developer implements their own variation," the post states.

Behavioural signatures fail for a different reason: legitimate applications produce the same telemetry. Caller identification applications, which have an obvious and legitimate reason to display something after a call ends, listen for exactly the same events. A rule that flags end-of-call display behaviour would sweep them up alongside the fraudulent applications.

User reporting is weakened by the evasion techniques already described, since a user who cannot attribute the behaviour to a specific application cannot report it. The combination allows these applications to pass through the pre-installation scanning that app stores apply, according to DoubleVerify, which is why the post argues that "collaboration between independent verification providers and platforms is essential". The company states that its own AI-powered detection methods identify the scheme across all variations observed. That claim originates with DoubleVerify and has not been independently verified.

Scale, and what it costs the buyer

The volumes disclosed are the sharpest part of the post. The DV FraudLab uncovers dozens of these applications every month, according to DoubleVerify, and collectively they are responsible for hundreds of millions of impressions.

Neither figure is broken down by region, ad format or exchange, and the post does not attach a dollar estimate to the wasted spend, which distinguishes it from earlier DV disclosures that carried explicit loss figures. What the company does describe is a second-order cost: an advertiser buying awareness inventory ends up associated, in the user's mind, with software that has taken over the device. The post argues that the user experience is the most significant pain point of the tactic, because the intended effect of a brand campaign inverts when the advertisement arrives as an interruption the user cannot explain or stop.

The post closes with a product argument for DoubleVerify's own fraud detection tools, which is standard for vendor research of this kind and worth reading as such.

The wider mobile fraud picture in 2026

AfterCall lands in a year when mobile inventory has attracted repeated scrutiny from measurement firms. AppsFlyer reported in June 2026 that organic traffic now accounts for 52 percent of all fraudulent mobile installs, drawing on 106.4 billion installs across 246,000 applications, a finding that undermines the organic baseline most mobile teams use to judge everything else.

DoubleVerify's own quarterly measurement points in a different direction. Its first-quarter 2026 benchmarks put the global fraud and sophisticated invalid traffic violation rate at 0.5 percent, down 24 percent year over year, while mobile application environments recorded the strongest display viewable rate of any device category at 82 percent. AfterCall inventory would plausibly clear a viewability threshold, since the advertisement occupies the screen in full, which illustrates how little a viewability figure says about whether an impression was welcome.

The DV Fraud Lab disclosed in September 2025 a surge in fraudulent mobile applications using artificial intelligence to mimic legitimate games and generate fake impressions. Three months before that, the same team published ShadowBot, a scheme that spoofed more than 35 million mobile devices and cost unprotected advertisers an estimated 2.5 million dollars in the first quarter of 2025. On the open web, DoubleVerify's AutoBait investigation in March 2026 exposed more than 200 domains generating clickbait with large language models at a reported cost of 2.25 dollars per article.

Rival researchers have documented structurally similar mobile schemes. HUMAN Security's Satori team uncovered Konfety in 2024, which used counterfeit versions of legitimate applications built on the CaramelAds software development kit. Two days before the AfterCall post appeared, PPC Land reported Satori's disruption of NewsJunkie, a connected television operation generating up to nearly two billion invalid bid requests per day per seller.

Platform enforcement has targeted this exact behaviour before. Google described in August 2025 how Gemini-based systems navigate applications and websites while mimicking user behaviour, specifically to detect accidental clicks, hidden advertisements and disruptive out-of-context advertisements, reporting a 40 percent reduction in deceptive ads. The company removed 352 applications tied to one operation during 2025 and eliminated close to 200 more from the Play Store in a separate case in February of that year. AfterCall applications are, on DoubleVerify's account, still getting through.

What it means for buyers of mobile inventory

The practical difficulty for a media buyer is that AfterCall impressions look acceptable on the metrics most campaigns are judged against. The advertisement renders at full size, remains on screen, and is served to a real device operated by a real person who has just finished a real phone call. Non-human traffic filters have nothing to catch. Viewability measurement registers a success.

The failure is contextual rather than technical, which places it in the same category as the made-for-advertising problem on the open web. IAS research published in July 2026 found mobile web display carried an MFA rate four times higher than the baseline, a reminder that mobile environments concentrate low-quality inventory across more than one delivery mechanism.

DoubleVerify extended content-level brand safety measurement into mobile applications in 2024 with 75 avoidance categories, a system built around what an application contains. AfterCall sits outside that frame, because the problem is not the content of the host application but the moment at which the advertisement is shown.

Context for the disclosure also includes the vendor's own position. A shareholder derivative complaint filed in December 2025 alleged that DoubleVerify executives misled investors about the effectiveness of its bot detection technologybetween November 2023 and February 2025, following a class action filed in May 2025 after a 36 percent single-day share price decline. Those proceedings concern financial disclosure rather than the technical findings published by the Fraud Lab, but they form part of the backdrop against which vendor detection claims are read.

Timeline

Summary

Who: DoubleVerify's Fraud Lab, through a post written by Nir Danon and published on the DoubleVerify Engineering publication. The applications described are attributed to unnamed Android developers.

What: An analysis of AfterCall ads, out-of-context advertisements triggered when a phone call ends. The mechanism combines the SYSTEM_ALERT_WINDOW overlay permission obtained through deceptive onboarding, a BroadcastReceiver registered at priority 998 for ACTION_PHONE_STATE_CHANGED events, and an Activity that displays the advertisement and then removes itself from the recent applications list.

When: July 13, 2026.

Where: Android devices globally, with the affected inventory transacted through mobile in-application advertising supply. DoubleVerify is headquartered in New York.

Why: The company states that its Fraud Lab uncovers dozens of these applications every month, collectively responsible for hundreds of millions of impressions. The pattern matters to advertisers because the impressions clear conventional viewability and non-human traffic checks while delivering an experience that associates the advertised brand with disruptive behaviour on the user's device.