Mobile Ad Fraud Scheme “Papyrus” Hijacks Novel‑Reading Apps to Generate Fake Ad Traffic
What Happened — Researchers at IAS Threat Lab uncovered a new mobile ad‑fraud campaign, dubbed Papyrus, that embeds a hidden orchestration layer (BootNova) inside popular novel‑reading apps. The layer silently launches hidden WebView browsers, clicks and scrolls ads, and even mutes consent dialogs, all while the user reads a story. The malicious activity is driven by a command‑and‑control server that can be re‑programmed without an app update.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the risk of third‑party mobile SDKs and bundled code that can subvert user devices and generate fraudulent revenue – a scenario SOC 2 vendor‑management controls are designed to detect and document.
- Continuous monitoring of third‑party app behavior provides audit‑ready evidence that your organization performed due‑diligence on the software supply chain.
- Aligns with Verisq’s Vendor Risk capability, which automates the collection of security attestations and real‑time risk scores for app providers.
Who Is Affected – Mobile app publishers, ad‑tech platforms, advertisers, and any organization that integrates third‑party SDKs into consumer‑facing applications (tech/SaaS, media, advertising).
Recommended Actions
- Conduct a vendor‑risk assessment of all third‑party SDKs and libraries used in your mobile apps.
- Deploy runtime monitoring to detect hidden WebView activity or unexpected network traffic from your apps.
- Update contracts to require security attestations, code‑review evidence, and continuous compliance reporting from SDK providers.
Source: Help Net Security
Technical Notes – The scheme uses a custom orchestration layer (BootNova) that contacts a C2 server, decodes the address with a Base64 + character‑shift cipher, and spawns “WebViewOut” workers to drive hidden browsers. JavaScript delivered at runtime can mute media, auto‑click consent dialogs, and replay user taps as synthetic clicks. No CVE is disclosed; the threat is a malicious code injection via third‑party app distribution. Source: same as above