Google has removed more than 115 Android apps from the Play Store after uncovering a large-scale ad fraud operation that infected over 25 million devices globally and siphoned advertiser budgets through a network of AI-generated websites. The scheme, known as Genisys, was identified through a joint investigation with Integral Ad Science (IAS), whose Threat Lab tracked the operation throughout late 2025.
Genisys operated through seemingly harmless Android utility apps such as QR code scanners, PDF readers, flashlights, WiFi detectors and wallpaper tools. Once downloaded, these apps ran hidden processes in the background, launching secret in-app browsers that pushed traffic to nearly 500 fabricated domains. These websites were generated using AI and designed to resemble legitimate blogs, news publishers or informational portals. In reality, they existed solely to generate ad impressions and monetise fraudulent engagement.
According to IAS, more than 25 million Android devices were compromised globally. Around one third of the activity originated in APAC markets including India, the Philippines, Indonesia, South Korea, Malaysia, Japan, Thailand, Australia, Vietnam and Singapore. Some of the malicious apps recorded millions of installs in the region alone, highlighting the scale of the operation.
What set Genisys apart was its systematic use of generative AI to mass-produce convincing publisher environments at low cost and high speed. The operation also relied heavily on app bundle ID spoofing, falsely presenting traffic as if it came from legitimate and widely installed platforms such as Netflix and Instagram. In some cases, single domains displayed traffic associated with hundreds of different bundle IDs, masking the true origin of impressions and making detection more difficult.
IAS Threat Lab first detected anomalies in September 2025 during routine monitoring. Suspicious patterns in user agents, IP addresses and engagement behaviour triggered further investigation. Even after initial removals, new low-effort utility apps continued to surface from related developer accounts, underlining the resilience and adaptability of the network.
Following confirmation of the scheme, Google removed the fraudulent apps from the Play Store. In addition, Google Play Protect will automatically disable Genisys-affiliated apps, including sideloaded versions installed outside the official store, and alert users if they attempt to interact with them. Since the takedown, bid request volumes linked to Genisys have reportedly dropped by more than 95 percent.
A Google spokesperson stated that collaboration with IAS and other industry partners is essential as fraud tactics evolve. Including Genisys, Google has pulled more than 870 Android apps tied to at least three large-scale ad fraud schemes in the past year.
For advertisers, the case signals a structural shift. As generative AI makes it easier and cheaper to fabricate domains, traffic and scale, fraud is becoming more industrialised. IAS recommends stricter supply path discipline, combined pre-bid and post-bid invalid traffic monitoring, and stronger cross-platform coordination. As AI accelerates the creation of synthetic environments, behaviour-based detection and ecosystem-wide collaboration are becoming critical safeguards for brands navigating the programmatic marketplace.
