Özgül Yavuz Kaddoura
Updated Date:
Google Cracks Down on Massive 'Vapor Threat' Ad Fraud Scheme Following IAS Report
What Was the Vapor Threat Ad Fraud Scheme?
In March 2025, the Integral Ad Science (IAS) Threat Lab uncovered a large-scale mobile ad fraud scheme codenamed Vapor, often referred to as Vapor Threat. Following the IAS report, Google removed more than 180 apps from the Play Store. The case shows how sophisticated ad fraud has become, and why advertisers can't rely on surface-level metrics alone.
Vapor wasn't simple bot traffic; it was a carefully disguised operation. The fraudsters published apps that looked legitimate, such as QR scanners, flashlights and health or fitness trackers. After installation, the apps stripped away their promised features, leaving behind a shell built for one purpose: showing endless full-screen video ads. The constant ads made users' devices nearly unusable while generating fraudulent ad revenue for the operators. To avoid detection, the fraudsters spread the apps across many developer accounts, each hosting only a handful of them.
The scale was huge. According to IAS, the apps collected more than 56 million downloads and generated over 200 million ad bid requests every day. Later research by the security company Bitdefender found that the campaign was even larger, involving as many as 331 apps with more than 60 million downloads in total.
How the Vapor Threat Scheme Worked"
The operators behind Vapor Threat combined several tactics to maximize their revenue and avoid detection:
Aggressive install manipulation: they used manipulative techniques to push up app rankings and install counts quickly; some apps passed 1 million installs in just 24 days. The high numbers made the fake apps look popular and trustworthy.
Multiple ad network integrations: by connecting each app to several ad networks through their SDKs, they maximized the number of ads they could serve and the revenue they earned from them.
Event manipulation: they manipulated in-app events to make the traffic look more legitimate than it was, which made the fraud harder to detect for anyone relying only on install numbers.
Why Vapor Threat Matters for Advertisers
Vapor Threat is a clear reminder that ad fraud keeps evolving and keeps getting more expensive. According to Juniper Research, advertisers are projected to lose $172 billion to ad fraud by 2028. Performance-based campaigns that rely on install or event metrics are especially vulnerable, because fraudsters are getting better at mixing fake activity with real traffic to pass basic checks.
The risk isn't limited to app developers. If you run Google Ads Display or Performance Max campaigns, or Meta Ads campaigns with Audience Network placements, your ads can appear inside mobile apps, including apps like the ones used in Vapor Threat. In those cases, you pay for impressions and clicks that come from devices flooded with fraudulent ads rather than from interested customers.
To reduce this risk, review your placement reports regularly and exclude mobile app categories that don't fit your audience.
How to Protect Your Campaigns from Schemes Like Vapor Threat
Vapor Threat shows that advertisers can't afford to be passive. Google removed the apps once IAS exposed them, but by then they had already served ads to millions of devices. To limit your exposure to schemes like this, focus on four areas:
| Validate your traffic sources | Don't take clicks, installs or impressions at face value. Review your campaign data regularly for unexplained spikes without matching engagement, or results that look too good to be true. |
| Review your app placements | In Google Ads Display and Performance Max campaigns, and in Meta Ads campaigns using Audience Network, check where your ads appear and exclude app categories or placements that don't fit your audience. |
| Use full-funnel fraud detection | Checking installs or clicks alone isn't enough. Use ad fraud detection tools that look at what happens after the click, such as engagement, session patterns and conversions, so your reports reflect real customer activity as closely as possible. |
| Educate your team | Make sure everyone involved in your campaigns understands how ad fraud distorts results and affects revenue, so investing in prevention gets the support it needs. |
More Than Just Lost Dollars: The Hidden Costs of Ad Fraud
The direct financial loss from schemes like Vapor Threat is only part of the damage. Sophisticated invalid traffic also affects your data, your decisions and your brand:
Skewed analytics: inflated impressions and clicks from fraudulent sources can make a campaign look successful when it isn't, or hide the weak performance of other channels.
Poor decisions: you spend time analyzing faulty data, and Smart Bidding or Meta's algorithm may shift budget toward the placements that produce fake activity.
Brand damage: in schemes like Vapor Threat, your ads appear as intrusive full-screen interruptions on devices that users can barely use. People may associate that frustrating experience with your brand.
Understanding Click Fraud on Google Ads and Meta Ads
Vapor Threat targeted app ad networks, but the same goal, making advertisers pay for activity that isn't real, also drives click fraud on Google Ads and Meta Ads. Google Ads click fraud refers to any invalid or illegitimate click on your ads, including clicks from:
| Automated bots | Software built to click on ads repeatedly, often while trying to look like real visitors. |
| Click farms | Groups of low-paid workers clicking ads manually and at scale. |
| Competitor clicks | Competitors clicking your ads on purpose to drain your daily budget. |
| Accidental clicks | Not malicious, but still costly: intrusive ad layouts, such as the full-screen ads in Vapor Threat apps, can lead to unintentional clicks that may be counted as valid. |
Vapor Threat shows how large ad fraud operations have become. Protect your Google Ads and Meta Ads budget with real-time click fraud protection.
Get Protected 
Frequently asked questions
Vapor Threat was a large-scale mobile ad fraud scheme involving more than 180 Android apps on Google Play. The apps looked like legitimate tools, such as QR scanners, flashlights and fitness trackers, and worked normally at first. After users installed them, the apps stripped away their features and showed endless full-screen video ads instead. The scheme avoided detection by spreading the apps across many developer accounts, each hosting only a handful of them, so no single account looked suspicious.
Install manipulation is a technique fraudsters use to push their apps up the Play Store rankings quickly. By artificially inflating install counts, some Vapor Threat apps passed 1 million installs in just 24 days, which made them look popular and trustworthy to real users. For advertisers, the result is that ads end up inside apps that exist only to show as many ads as possible, often as intrusive full-screen interruptions that real people never chose to watch.
Modern schemes like Vapor Threat don't just fake the install; they also manipulate the in-app events that follow, so the traffic looks more legitimate than it is. That's why install numbers alone can't tell you whether your ads reached real people. Effective bot traffic detection looks at what happens after the install or click, such as session length, engagement and conversions, to separate real users from fake activity. Relying only on install or click counts leaves you exposed to sophisticated invalid traffic.
ClickSambo protects your Google Ads and Meta Ads campaigns from the invalid clicks that schemes like Vapor Threat can send your way, for example through Display, Performance Max or Audience Network placements inside mobile apps. Every click on your ads is checked in real time using four layers: device fingerprinting with Stable Device ID, VPN, proxy and Tor detection, click velocity thresholds and behavioral AI. Suspicious sources are blocked as soon as they're detected, and every blocked click is shown in your dashboard, so you can see where invalid traffic comes from.
Other