Integral Ad Science published a Halloween-themed roundup on October 21, 2026 that gathers three of its Threat Lab investigations from the past eight months into a single post: an AI-built fraud network called Genisys, a set of desktop applications that kept refreshing ads out of view, and a scheme named Papyrus that hid a browser behind novel-reading apps. The post, titled "Nightmare on Ad Street: Unmasking 2026's Spookiest Ad Threats" and credited to the "IAS Team," contains no new research. Its value lies in the comparison it invites. Read next to the original reports, which it links, the roundup keeps the most striking figures and drops several that matter as much to buyers - including the one number in the Genisys headline that the Genisys report itself never substantiates.

In Short

An ad verification company put three of its old fraud investigations into one spooky-season blog post. Each one describes apps on phones, tablets or computers that load ads or websites when no person is looking, which means advertisers can pay for views and clicks that no human made. The post adds no new numbers, and some figures from the original reports, such as Papyrus's estimated $1 million a month and Google's removal of the Genisys apps, are missing from it.

What the post is

The page sits in the Threat Lab topic of IAS's Insider blog and runs to roughly 650 words. It opens with a horror-film device. "In a classic horror movie, the twist is realizing the call is coming from inside the house," according to IAS. "In ad tech, the surprise can be just as unsettling: suspicious activity hiding inside familiar apps and everyday devices."

Three short case summaries follow, each tied to a hyperlinked earlier report. The order in the post runs Genisys, desktop apps, Papyrus. The order of publication was the same: the Genisys report is dated February 26, 2026, the desktop app report May 15, 2026, and the Papyrus report August 6, 2026, according to the dates IAS lists under "Related posts" at the foot of the page.

The post closes with a sales prompt. "Reach out to your IAS representative to learn how IAS helps uncover invalid traffic before it haunts your campaign performance," according to IAS. That framing matters for how the figures should be read. Every number in the roundup comes from IAS's own analysis of traffic it measures, none has been independently replicated in the material IAS published, and the company sells the detection services the post promotes.

Genisys: nearly 500 domains and a disputed device count

The first item concerns an operation IAS calls Genisys. "In Inside Genisys: The 25-Million-Device Fraud Network Built with AI, IAS Threat Lab uncovered an operation that used everyday smartphones and tablets to load websites in the background, without users' knowledge," according to the roundup.

The traffic went to sites built for the purpose. "The traffic flowed through nearly 500 AI-generated domains posing as blogs, news sites, and other web properties," according to IAS. The post adds that "Genisys also used app bundle ID spoofing to obscure which apps were generating the activity," and that "across a network spanning 25 million devices, the operation generated hundreds of millions of bid requests."

An app bundle ID is the string that identifies a mobile app inside an ad request. When it is spoofed, a buyer bidding on what looks like inventory from a popular app may actually be paying for impressions generated somewhere else entirely. The February report describes the effect in more detail: many of the reported bundle IDs correspond to apps with tens or hundreds of millions of installs, and "the bundle IDs do not reflect the apps actually generating the hidden in-app browser sessions," according to IAS.

Where the 25 million comes from

The device figure is the headline number of the Genisys story, and it appears in the roundup as a plain fact. In the February 26 report, however, it appears only in the title. The body of that report describes the operation as embedded in smartphones and tablets across multiple markets and quantifies its output as "hundreds of millions of bid requests," but it does not state how many devices were involved or how IAS arrived at 25 million. Neither document gives a counting method.

That gap is not trivial. A device count of that size implies a scale comparable to some of the largest mobile fraud operations disclosed in recent years. HUMAN's Satori team described the Konfety operation in July 2024 as involving more than 250 Play Store apps and up to 10 billion fraudulent ad requests a day at its peak, figures HUMAN tied to specific measurements. Without a method, the Genisys device count cannot be compared with such disclosures on equal terms.

What the roundup omits

The February report contains facts that the October recap leaves out. IAS says its Threat Lab shared intelligence with Google's Play Store team, which led to enforcement against the identified apps. "Google Play Protect will warn users and automatically disable apps known to be associated with Genisys," according to the report, including apps installed from outside Google Play. For a representative set of Genisys apps, "bid request volume dropped by more than 95% and has remained near zero since the removal of the identified apps," according to IAS.

The report also traces the operation's geography. In September 2025 the top affected regions were mainly in North America, and by the end of 2025 the top ten spanned APAC, LATAM and EMEA, with two to three new countries added each month in the fourth quarter, according to IAS. One developer account had published 13 apps, all of which have since been removed or made inactive.

None of this appears in the Halloween post. For a buyer reading only the roundup, Genisys looks like an ongoing threat. On IAS's own account, the identified apps were largely shut down months ago.

Desktop apps: ads that keep refreshing out of view

The second item moves from phones to computers. "Ad-supported desktop apps can be a valuable source of inventory. But what happens when an app keeps refreshing ads after it's minimized - or even after the device is locked?" according to the roundup.

The May 15 report, titled "Desktop App Supply Is Booming, Transparency Needs to Keep Pace," examined how desktop applications represent and deliver ad inventory. The roundup summarises it evenly. "While many implementations aligned ad behavior with user activity, the team also found cases where ads continued refreshing out of view," according to IAS.

Two further behaviours are listed. "Other findings included apps generating ad requests across multiple domains and modifying browser signals in ways that made app traffic look like ordinary web traffic," according to the post. "For buyers, those behaviors can make it harder to tell where an impression came from and whether anyone had a chance to see it."

The technical detail behind the summary

The original report is more specific. One app generated requests across a primary domain and four associated secondary domains, each presented as a standalone website, according to IAS, and the secondary-domain traffic was produced inside the app rather than by people visiting those sites. In one implementation, Chromium's background throttling had been disabled on the ad webviews, so ad timers and refresh cycles kept running regardless of visibility. Some apps intercepted outbound requests and rewrote Client Hint headers to match standard Chrome values, which makes an app's traffic hard to distinguish from that of an ordinary browser.

Those are significant mechanisms. Browsers throttle background tabs precisely so that hidden pages stop consuming resources; switching that off for ad slots alone lets an app keep generating impressions while the screen is dark. Rewriting Client Hints, the headers a browser uses to describe itself, removes one of the signals buyers and verification vendors rely on to identify where an impression ran.

What the May report does not provide is scale. IAS says it analysed "a broad set" of desktop applications over several months but gives no count of apps examined, no share of desktop app impressions affected and no growth figure to support the "booming" in its title. The roundup does not add any. Readers have no way to judge from either document whether out-of-view refreshing is an edge case or a common pattern.

The post's line on the matter is a joke rather than a measurement. "If an ad renders on a locked screen in an empty room, does it make a sound? Maybe not. But it does raise questions about the impression," according to IAS.

Papyrus: phantom engagement and the 25x figure

The third item has the most numbers. "Someone opens a novel app and settles in to read. Behind the story, a hidden browser gets to work," according to the roundup.

IAS says the reading apps loaded websites in the background. "The scheme could also generate clicks and scrolling on pages the reader never chose to visit," according to the post. Those synthetic interactions changed how the traffic looked in reporting. "In IAS's analysis, Papyrus traffic showed a nearly 25-times-higher click success rate and attention scores about 13% higher than comparison traffic," according to IAS.

The post's conclusion is direct. "While people read stories in the app, Papyrus generated clicks and scrolls on websites they never saw. That's phantom engagement advertisers could mistake for real interest," according to IAS.

Why higher engagement is the warning sign

The Papyrus figures invert a common assumption. Fraud is often pictured as low-quality traffic that underperforms. Papyrus, on IAS's numbers, outperformed. A campaign optimised toward clicks or attention metrics would, in principle, have shifted budget toward it. That is the practical danger for buyers who use engagement as a proxy for quality: a scheme that fabricates scrolling and clicking will look better than a real reader who does neither.

There are limits to how far the comparison can be pushed. Neither the roundup nor the August report defines "click success rate," states sample sizes or says what "comparison traffic" consisted of beyond non-Papyrus inventory. The 13% attention uplift is measured on IAS's own attention scoring, so it describes how Papyrus traffic fooled that particular model rather than an industry-standard measure.

Numbers the recap drops

PPC Land reported on the Papyrus findings on August 7, 2026, the day after IAS published them. The original report put the scheme's footprint at more than 800 domains and nearly 8,000 unique host values, with a published indicator list of 812 domains. It also estimated that Papyrus may have generated close to $1 million a month in monetisation impact at its peak, and that its effective cost per thousand impressions ran roughly four times higher than comparison traffic.

The roundup mentions none of those. The omission of the eCPM figure is notable: a fourfold price premium is the clearest sign of who paid for the fabricated engagement. The $1 million estimate also came with a method IAS disclosed in August - the company calculated eCPM on the portion of Papyrus supply it observed directly, then applied that rate to a larger impression footprint estimated from supply-path data - and with no stated observation window. The August report did not name the apps in its text, the operating system or the app stores involved.

The common thread: inventory that looks like something else

All three cases share a structure. Each involves software on a real device that presents its output as something it is not. Genisys disguised in-app browser sessions as visits to editorial websites and disguised the apps generating them through spoofed identifiers. The desktop apps examined in May presented app traffic as browser traffic and kept ads running when no one could see them. Papyrus dressed background page loads as engaged reading.

The roundup draws the lesson itself. "The scariest threats don't always announce themselves. They can hide behind a familiar app, a legitimate-looking domain, or engagement metrics that seem too good to question," according to IAS.

For buyers of programmatic supply, the categories matter because each defeats a different check. Domain-level blocklists struggle with networks that spin up hundreds of AI-generated sites, a pattern PPC Land has tracked since IAS flagged AI-generated "slop" sites as a quality threat in July 2025, when the company pointed to Synthetic Echo, a network of more than 200 AI-generated websites. The wider category of made-for-advertising sites raises similar issues of inventory built for ad revenue rather than readers. App-level controls fail when bundle IDs are falsified, a weakness Pixalate documented in connected TV in May 2024, when it found that between 26% and 67% of bundle IDs on major CTV platforms were malformed or fraudulent. Viewability and engagement signals fail when software fabricates them.

The volume dimension is captured in the bid request counts IAS cites. "Hundreds of millions" of requests from Genisys entered auctions where demand-side platforms evaluated them as ordinary supply. Each request that wins becomes a billable impression, which is why invalid traffic remains a budget question rather than only a technical one.

Similar findings elsewhere

IAS is not alone in reporting app-based schemes this year. DoubleVerify reported in July 2026 that its Fraud Lab finds dozens of so-called AfterCall Android apps every month, which together account for hundreds of millions of impressions a month by showing ads after phone calls end. DoubleVerify's 2024 Global Insights Report preview, covered by PPC Land in June 2024, said new fraud schemes and variants rose by more than 20% year over year in 2023 and attributed part of the sophistication to generative AI. Each vendor publishes its own findings on its own measured traffic, and the figures are not directly comparable.

Context for IAS

The roundup lands during a period of change at the company. Novacap agreed to acquire IAS for about $1.9 billion in an all-cash deal in September 2025, and Lidiane Jones became chief executive in July 2026. The company's recent product news has centred on generative AI content: it moved its low-quality AI content avoidance tool to general availability in May 2026, extended it to YouTube on September 30, 2026, and on October 5, 2026 described its role in a closed brand safety pilot for ChatGPT Ads, an arrangement OpenAI's own account described as more limited than IAS's post.

Against that backdrop, the Halloween post functions as a reminder of the company's fraud research rather than as a disclosure. None of its numbers is updated to October, and it makes no claim that any of the three schemes is still active. Its links point readers to the full reports, which contain both more detail and more caveats than the summary.

What the material does not establish

Several questions remain open after reading the roundup and the three reports it links. The 25 million device figure for Genisys has no stated method in either document. The desktop app report gives no count of apps or impressions affected. The Papyrus comparisons rest on undefined metrics and unstated sample sizes, and the August report did not name the operating system or app stores involved. IAS does not say whether any of the three schemes continues, apart from the near-zero bid request volume it reported for the representative Genisys apps after their removal. And none of the findings has, in the published material, been verified by a party other than IAS.

Timeline

Summary

Who: Integral Ad Science and its Threat Lab research team, with advertisers and programmatic buyers as the affected audience. Google's Play Store team acted on the Genisys findings, according to IAS.

What: A roundup post recapping three earlier IAS investigations: Genisys, which IAS says used smartphones and tablets to send hidden traffic to nearly 500 AI-generated domains with spoofed app bundle IDs; desktop apps that kept refreshing ads out of view and disguised app traffic as browser traffic; and Papyrus, whose reading apps generated clicks and scrolls with a nearly 25-times-higher click success rate and attention scores about 13% higher than comparison traffic. The post contains no new data and omits several figures from the original reports.

When: The roundup was published on October 21, 2026. The underlying reports date from February 26, May 15 and August 6, 2026.

Where: On IAS's Insider blog under the Threat Lab topic. The schemes affected mobile devices across multiple markets, including North America, APAC, LATAM and EMEA in the case of Genisys, and desktop computers.

Why: Each scheme makes ad inventory appear to be something it is not, defeating checks based on domains, app identifiers, visibility or engagement. Buyers who optimise toward clicks or attention can end up favouring fabricated traffic, and the gaps in IAS's published methods leave the scale of the problem hard to judge independently.