Ad networks trigger fake splash ads using incidental interactions
When Ad Networks Misbehave: Understanding Risks of Semi-Drive-By Splash Ads
Cryptography and Security
Summary
Some mobile ads appear on full screens when you open an app, and they make money from people touching them. The authors found that ad networks sometimes trick the system by counting accidental touches or minor device movements as real clicks, which cheats advertisers and annoys users. To discover this, they built a tool called AdHive that mimics normal phone use to catch these sneaky ads. Their tests showed this fraud happens a lot and even led to a big advertiser in China getting refunds for overcharging.
What this means in practice
- •For mobile app developers: Detect and prevent inflated ad engagement metrics caused by incidental touches and sensor-triggered fake splash ads in mobile apps.
- •For digital advertisers: Identify and demand repayment from ad networks that charge for fake user interactions triggered by indirect or incidental device signals.
Authors
Song Wu, Bo Wang, Yifan Zhang, Yinfeng Cao, Xueqiang Wang
Abstract
We investigate the mobile splash ads ecosystem, i.e., full-screen advertisements shown at app launch, where monetization relies on interaction signals that are difficult to verify end-to-end. This setting is especially sensitive because incidental touches and sensor-driven callbacks are common yet easy to misattribute as engagement. Prior work has largely framed mobile ad fraud as a publisher-side problem, while some studies attribute fraudulent operations to embedded ad libraries. Yet an important risk remains underexplored: ad SDKs control how interaction signals are interpreted, measured, and reported, creating an opportunity to reinterpret ambiguous user or device signals as valid advertising interactions. We uncover a previously less-known form of fraud at the ad-network layer in which splash ads are triggered not by intentional user actions but by incidental or indirect interactions, which we term semi-drive-by splash ads. By translating non-ad interactions into billable engagement events, ad networks can inflate performance metrics, overcharge advertisers, and erode user trust. To expose this behavior in the wild, we design AdHive, an automated honeypot-like analysis framework that induces evasive splash-ad delivery and landing behaviors under realistic device conditions. AdHive reproduces human-like activity through LLM-generated usage traces and sensor dynamics, enabling execution paths that remain hidden in conventional analysis environments. Our large-scale measurement across thousands of popular Android applications shows that semi-drive-by splash ads are widespread and are often triggered by subtle signals such as minor sensor variations. We further confirm real-world impact by working with one of China's largest advertisers, identifying multiple ad networks engaging in this fraud and leading to enforced repayments of about 4 million Yuan (approximately US$600,000).