They’re Back: Fraudsters Are Trying to Expand Their CTV and Mobile Ad Bot Schemes

The bad actors behind ShadowBot don’t give up easily. 

In late 2024, the DV Fraud Lab discovered (and named) ShadowBot, a scheme siphoning off ad spend from programmatic premium inventory. ShadowBot’s original execution was amateurish. Nevertheless, DV estimates that it costs unprotected advertisers as much as $2.5 million.

Once DV mitigated and publicized the scheme, ShadowBot’s operators didn’t give up completely. Unlike many other bad actors, they persisted, adapted, improved and scaled. ShadowBot is still out there, and DV estimates it has now generated over 1.6 billion fraudulent impressions — and counting! —  across advertisers that lack proper protections. 

Bot fraud schemes tend to focus on emerging media opportunities that are gaining ad spend – in recent years, the Fraud Lab even identified one involving smart refrigerators. In 2025, the majority of the 50+ bot attacks and variants DV uncovered, including ShadowBot, were hitting streaming formats, especially CTV. 

In the latest development, these scammers are reaching beyond programmatic buying channels to infiltrate the safest-seeming streaming inventory: That which is purchased through direct deals with premium CTV and OLV platforms.  

DV Fraud Lab vs. ShadowBot: The Battle Continues 

ShadowBot started out as a relatively simplistic operation. When we first encountered it in late 2024, it was generating falsified ad impressions by spoofing mobile devices and app IDs, as well as over three million device signatures a day. 

Still, it was fairly easy to identify as a scam. The “premium streaming traffic” it was selling was coming from “devices” that were clearly fraudulent. For example, details on some of ShadowBot’s supposed impressions included screen resolutions associated with old-school cathode ray tube televisions – the ones flat-screen technology made extinct almost two decades ago. 

Smarter, Faster, Bolder and Coming For Your Direct Deals

Over time, ShadowBot has begun to mimic the profiles of modern devices and develop adaptive patterns, likely aided by AI. This increasing sophistication allows it to falsify up to 200 million monthly impressions for advertisers that lack proper protection.  

ShadowBot variants continue to emerge, too, with differing levels of sophistication. Some are easily recognizable and avoidable; others are more deceptive and are finding their way into the inventory of reputable platforms.

Findings from five DV Fraud Lab investigations demonstrate the extensive waste that bot fraud schemes and their variants inflict on campaigns, even when advertisers believe they are buying premium inventory from direct sources:

Pre-Bid Fraud Protection For Your CTV Campaigns 

The good news: DV clients who activate pre-bid sophisticated invalid traffic (SIVT) protection are shielded from the vast majority of bot schemes. Our pre-bid fraud protection includes optimization away from invalid device types. In addition, our data shows it effectively mitigates the vast majority of invalid traffic exposure.  

When these protections are enabled, CTV fraud rates typically decrease dramatically. They can be 12 times lower on some platforms.  

As the year ends and pressure increases on marketers to meet campaign KPIs, and as fraudsters ramp up their activity during the high-traffic holidays, DV strongly recommends that our clients fully enable pre-bid protection across all campaigns, particularly in video and CTV environments.  

Next Steps

Contact DV.
Learn more about protecting your CTV and streaming campaigns with DV.