A new mobile ad fraud scheme, dubbed Papyrus, has been identified, utilizing a cluster of novel-reading applications to generate concealed browser traffic on users' devices. While users engage with the visible app interface, the applications surreptitiously load websites in hidden browser windows, autonomously clicking and scrolling through them.
The scheme is built around an orchestration layer called BootNova, which manages the hidden browser activity within the apps. BootNova communicates with remote command-and-control (C2) infrastructure to receive configuration instructions. These instructions dictate whether the hidden activity should run, its timing, geographic targeting, retry behavior, the number of active webviews, destination URLs, and how those webviews should interact with loaded pages.
Once BootNova receives its instructions, it delegates tasks to "WebViewOut" workers, which are responsible for opening and managing the unseen browser windows. A wrapper, CWebViewPlugin, keeps these windows attached to the app's interface while positioning them behind the visible content. Some apps further obscure this activity by layering a cover view on top. To evade detection, BootNova employs an RsaUtils module to decode the hardcoded C2 address and server communications using Base64 and a character-shifting cipher, preventing the address from appearing in plain text.
Papyrus employs multiple methods to automate interactions within the hidden browser windows. Some JavaScript is embedded directly into the app, allowing it to track user taps on the visible screen and replay them as synthetic touches, clicks, or scrolls in the hidden browser. Additionally, JavaScript can be delivered from the operator's servers at runtime, enabling dynamic changes to the hidden browser's actions on any page without requiring an app update. This server-delivered JavaScript has been observed muting media elements and automatically clicking page elements like consent dialogs. A third layer involves "click and scroll modules" that pass user taps from the visible reading screen into the hidden webviews, registering them as clicks in the background.
The automation within Papyrus is not random; it utilizes "movement recipes" that define specific click coordinates, scroll ranges, delays between actions, ad-close coordinates, and navigation behavior. These recipes are selected through probability gates, ensuring varied behavior rather than simple, repetitive patterns. Novel-reading apps were specifically chosen for this scheme because users typically spend extended periods within them, providing ample opportunity for hidden web monetization.
The scale of the Papyrus operation is significant, linked to over 800 domains and nearly 8,000 unique hostnames. The majority of these are gaming sites, blogs, news-style pages, and AI-generated content designed to receive traffic rather than serve an audience. Analysis of this traffic revealed a click success rate nearly 25 times higher than non-Papyrus traffic, an effective cost per mille (eCPM) approximately four times greater, and attention scores 13 percent above normal. This suggests that the fraudulent traffic not only appeared legitimate but also seemed more valuable than authentic traffic.
Based on observed rates and the portion of Papyrus's supply that could be directly monitored, it is estimated that the scheme generated close to $1 million per month at its peak. The researchers warn that hidden page loads alone can create invalid traffic, but when combined with automated clicks and scrolling, they can distort performance reporting and attention-based evaluations. This can lead to misinformed campaign optimization strategies, where advertisers inadvertently allocate more budget to the very traffic that is defrauding them.
