DoubleVerify detects hidden iOS ad fraud

DoubleVerify’s Fraud Lab has discovered a new fraud scheme lurking on customers’ mobile devices. It uses innocent-seeming iOS gaming apps to charge advertisers for phony ad impressions.

Operated by independent cybercriminals using a shared framework called UniSkyWalking, the scheme, which our Fraud Lab has dubbed SkyWalk, is sophisticated, coordinated and very difficult to detect. Our researchers discovered it after noticing a number of apps with abnormally high impression rates and unreasonable click behavior.

How the Scheme Works

SkyWalk fraudsters have embedded secret web browsers inside various iOS gaming apps. These apps are downloadable in the App Store and appear legitimate. Their games are playable.
 
But when a user opens one, the app also secretly launches hidden websites on the user’s iOS device. As the user plays “Sushi Party” or “Bicycle Race” in the app, the hidden sites run in the background, undetected, serving ads no one sees.
 
Impressions are reported. Advertisers get billed. Not a single ad is viewed by a human.

A Big Year for Malicious Apps

DV has reported a surge in AI-powered ad fraud this year, including a spike in malicious apps. On iOS, the average volume of fraudulent apps DV identified during the first three quarters of 2025 is over three times that of the previous five years.

Even so, SkyWalk is a standout. It involves dozens of fraudulent apps concealing over 80 fake gaming websites that generate millions of manipulated ad impressions. It employs hidden browser technology to render its websites completely invisible to users and uses touch hijacking to generate premium ad formats. Profit sharing is coordinated among multiple fraud participants.

The SkyWalk fraudsters use AI-generated content to make their fake websites appear legitimate during audits, even though the sites receive no organic traffic. And in auction data, the scheme misrepresents mobile app traffic as website traffic to evade Open Measurement SDK, the industry-standard detection tool that monitors in-app ads but not browser-based ads.

Who Gets Hurt?

SkyWalk impacts marketers by wasting ad spend while delivering no brand awareness. It inflates performance metrics, which can skew campaign optimization efforts.

Consumers, too, are unwitting victims. While they play games on these malicious apps, the hidden websites running in the background are draining their devices’ battery power, processing power and memory. Their devices can even overheat.

Sophisticated Schemes Require Sophisticated Knowledge
Standard measurement tools aren't enough to catch SkyWalk. Marketers should seek out advanced fraud detection from verification providers with the technical expertise to perform sophisticated analysis. Continuous monitoring is also critical, as fraud networks evolve and new schemes emerge.