By Shahar Shoam and Lisa Toledano, the DV Fraud Lab
When the general public hears the term “generative AI fraud,” the mind immediately jumps to high-stakes personal drama: a deepfake video of a grandchild begging for bail money or a sophisticated phishing attack targeting a lifetime’s worth of savings. These individual fintech scams are undeniably alarming. Yet they are nearly overshadowed by a much larger, invisible reality.
On a macro level, the most lucrative digital crime isn't necessarily stealing someone’s credit card; it’s tricking a corporation into wasting millions of advertising dollars on ads served to an “audience” that isn’t human at all.
When you pair the scale of attacks with the high cost of premium formats such as CTV, it’s no wonder that adtech fraud loss is projected to reach $170 billion by 2028. Unlike bank scams that target one person at a time, adtech fraud operates entire ecosystems, siphoning billions from the digital advertising industry while remaining hidden in plain sight.
In the following examples, uncovered by the DV Fraud Lab, we illustrate how shell operations generate dozens of CTV channels and/or apps that are merely vehicles for fraud. What might seem like a harmless app is actually a front for trafficking hundreds of millions of bot interactions. When attackers have reason to believe that their operations are compromised, they often switch to a new shell company name, where they can keep practicing the same scheme over and over.
To Find the Fraud, Follow the Supply Chain
Why do certain adtech fraud operations remain active for nearly a decade? The answer lies in the DNA of the digital advertising supply chain. In most industries, following the money is straightforward: a fraudster steals a product and keeps the profit. In adtech, however, the money passes through an elaborate chain of middlemen.
This complexity allows fraud to remain active for years. Attackers often present themselves as authorized resellers, hiding within a crowded ecosystem of platforms and agencies. From a digital strategist’s perspective, the most alarming aspect is how these platforms unintentionally double or triple the financial impact, because many different buying platforms may find themselves charmed by the promise of low-cost inventory offered by the same scheme. This cascading effect turns one bot-driving server into multiple layers of wasted spend, as platforms unknowingly buy and resell the same fraudulent traffic to one another.
One of the first signals to make a network of fraud detectable is to look up the inventory associated with it. In a recent example exposed by the Fraud Lab, a group of CTV apps was using identical lotus flower logos, nearly identical descriptions and similar names: YogaCure, CoreYoga, Yoga Healing, YogaPro and MegapureYoga.
The apps in this scheme, which we’ve named YogaBait, were allegedly published and operated by separate companies, yet their data patterns showed that they were set up as preparation for selling fake traffic. There was very little effort invested in their content; they all shared the same yoga class content, stock photos and descriptions.
Data Does Not Lie
Unveiling connections between graphic assets that tie shell operations together is only half the story. The real evidence came from tracking how traffic moved between apps as we classified them. DV’s AI agents analyzed data patterns and found connections that go far beyond shared app catalogs. Identical bot traffic signatures were found across entities, specifically CycloneBot, a sophisticated CTV fraud scheme DV exposed in 2024. Apps from different publishers showed matching CycloneBot patterns, confirming that they shared the same infrastructure for falsifying ad impressions.
The following example shows how traffic patterns on allegedly unrelated apps were showing a coordinated handoff. When DV classified one entity's yoga app, impressions immediately dropped. Within the same month, a brand new yoga app by a seemingly unrelated developer appeared and immediately absorbed the displaced bot traffic. This shell game is a relentless evasion tactic, a classic whack-a-mole game, where DV vigilantly catches new attacks as they emerge.
For AI Shell Companies, the Bar is Low
When attackers try to evade detection, generative AI becomes their new best friend. Fraudsters use AI to generate compelling digital publisher or reseller identities in minutes. DV’s investigation into shell operations reveals just how thin the facade has become.
Consider Unholy Tech Unlimited, a bogus media reseller detailed in The Fraud Fighter's AI Playbook, co-authored by the DV Fraud Lab’s Gilit Saporta. The scheme needed only a minimal digital footprint to start operating and selling traffic.
To name a few signals: The website, unholytech.xyz, was filled with placeholder text. Services were described with generic terms, and the Meet Our Team section featured stock photos and made-up names. The same avatars and templates also appeared on another bogus website called BumpBots.
The same stock photo images and made up names are shared by unholytech.xyz and bumpbots.com, 2025. Source: oreilly.com/library/view/the-fraud-fighters/9798341660359
The "Yoga-Bait" Shell Game and The Perfect Storm of CycloneBot
The most sophisticated frontier of this crime is faking traffic to persuade brands that they’re buying genuine CTV inventory. The YogaBait network is a prime example, because the apps associated with the network kept selling CycloneBot traffic, switching between apps easily, as the cost of generating their yoga content was near zero.
The apps have effectively turned yoga classes into a high-reward technical tactic for capturing ad revenue with zero investment in genuine audience. Given that CTV is the high-rent district of digital advertising, the DV Fraud Lab invests continuously in collaboration with fellow fraud-fighters to keep the industry safe and transparent.
Every new fraudulent network is tracked by the DV team, mapped and addressed as soon as its data signals allow mitigation. As seen below, in a map of spoofed apps and shell operators tracked by DV, some networks turn out to be large interconnected webs, with dozens of assets that stay active for years. It’s important to keep playstores and platforms safe from these schemes.
The Value of Transparency
DV tracks down CTV fraud operations even as they use fragmentation tactics to keep spreading inventory across the industry. AI-powered fraud schemes will keep deploying dozens of apps and accounts so that if one is blocked, the rest of the network survives. It is up to the whole ecosystem to keep its shields up against falsification.
Over the years, digital advertising fraud schemes have shifted from cheap tricks to AI-accelerated deception. Apps like the YogaBait operation drain your CTV budget by serving ads to bots, not real viewers.
Individual apps in the YogaBait network generated millions of impressions at their peak, all wasted spend on falsified inventory. As this network cycled through corporate rebrands, traditional blocklists failed to keep pace.
Traditional vetting is failing. We are seeing a zombie apocalypse of fraud, where bad actors even inhabit "dead" or abandoned developer accounts to eat up ad spend under the guise of established names. The industry must evolve from manual checklists to advanced pattern recognition that can spot these digital fingerprints in real time.
DV's pattern recognition catches fraud at scale with surgical precision. AI-powered detection identifies fraudulent apps across multiple shell entities, sees through fake rebrands, and protects your spend, no matter what name appears on the paperwork.
Related Topics
Recent Posts
