Integral Ad Science (IAS) has released a major report on a massive Generative AI ad fraud scheme, referred to as Genisys, from its in-house research arm, IAS Threat Lab.
IAS Threat Lab worked in close partnership with Google to mitigate the Genisys threat. This resulted in the removal of the identified fraudulent versions of these apps from the Google Play Store.
Genisys
Previously, the IAS Threat Lab published research on Arcade, another mobile ad fraud scheme. Mobile apps generated hidden in-app browser activity to load websites in the background and convert mobile-origin activity into web traffic.
Following the publication of Arcade, the IAS Threat Lab continued to monitor related activity across mobile apps and web infrastructure.
As this monitoring continued, new traffic patterns and domain behaviours emerged that were not consistent with earlier infrastructure. These changes led to the identification of a distinct operation, now referred to as Genisys.
Malicious apps
Genisys involves 115 mobile apps representing more than 25 million installs, placing the operation on tens of millions of consumer devices globally. At this scale, the fraud was embedded directly within everyday smartphones and tablets across multiple markets.
Devices were hijacked to run malicious activity in the background, diverting processing power and network resources without users’ knowledge or consent and without delivering any legitimate user benefit.
The scheme was extremely large, reaching over 25 million devices, with a network of nearly 500 AI-generated domains.
Unlike earlier iterations of this scheme, most of these domains were created using AI-generated tools. They appeared as generic blogs, news-style sites, and informational properties produced at scale, built not to attract real audiences but to receive and monetise fraudulent traffic.
Collectively, they formed a synthetic web ecosystem designed specifically to launder app generated activity into seemingly legitimate web inventory.
Hiding in plain sight
Traffic reaching Genisys domains was attributed to hundreds of distinct mobile apps, corresponding to apps with tens or hundreds of millions of installs. This attribution is misleading.
Analysis showed that the bundle IDs did not reflect the apps actually generating the hidden in-app browser sessions.
Instead, they were used to flood domains with implausibly diverse sources, creating attribution noise that made it difficult to identify the true origin of traffic.
As a result, a single domain might appear to receive traffic from hundreds of unrelated apps, effectively masking the small set of apps actually responsible for the activity. This technique significantly reduced the effectiveness of attribution-based detection.
Left undetected, activity of this kind can create financial risk, weaken marketplace integrity, and distort performance signals.
Geographical spread
Genisys activity expanded geographically and by the end of 2025, the top ten composition consistently spanned Asia Pacific (APAC), Latin America (LATAM), and Europe Middle East & Asia (EMEA).
Two to three new countries were entering each month from newly represented regions.
Tackling Genisys
Working closely with Google to disrupt the Genisys operation, IAS shared actionable intelligence with Google’s Play Store team, which led to enforcement actions against the identified apps.
Following these enforcement actions, supply from affected apps declined sharply.
In future Google Play Protect will warn users and automatically disable apps known to be associated with Genisys, even when they originate from sources outside of Google Play.