IAS Threat Lab has uncovered Papyrus, a mobile ad fraud operation that hides web browsing, clicks, and scrolling inside popular novel-reading apps.
The scheme turns long reading sessions into a source of fraudulent web traffic while users remain unaware that activity is running in the background.
The apps appear to offer serialized fiction and long-form stories. However, IAS researchers found that some of them secretly open browser components known as webviews behind the visible reading interface.
These hidden webviews visit websites, load pages, generate ad traffic, and perform actions designed to look like genuine user engagement.
Papyrus is especially concerning because it does not only create page visits. It can also generate artificial clicks, scrolling, consent-dialog interaction, and other signals that advertisers may interpret as high-value engagement.
Papyrus Test Mode Exposed
At the center of the operation is an orchestration component called BootNova. When a Papyrus-linked app launches, BootNova contacts remote command-and-control, or C2, infrastructure for instructions.
The server can decide whether to activate hidden activity, select destination URLs, control timing, set retry rules, and determine how many browser windows should run.
BootNova creates these hidden browser windows through workers called WebViewOut. The webviews are placed behind the app’s visible interface using native view layering.
A custom wrapper called CWebViewPlugin keeps the browser active in the app’s view hierarchy while a reading screen or cover layer hides it from the user.
As a result, a person may be reading a chapter inside an ebook app while the device quietly loads websites and interacts with advertising content in the background.
IAS identified more than 800 domains and nearly 8,000 unique host values tied to Papyrus. The destinations include gaming, blog, news-style, and generative AI content sites.
These sites appear designed mainly to receive and monetize traffic rather than serve meaningful audiences. The use of novel-reading apps is a key part of the fraud model.
Reading apps often keep users engaged for long periods, unlike utility apps opened only briefly for a single task.
This gives Papyrus more time to load pages, rotate through destinations, and perform automated activity without interrupting the visible experience.
Papyrus also uses embedded and remotely delivered JavaScript. The scripts can capture click coordinates, trigger synthetic touches, scroll pages, mute media, and automatically dismiss or accept consent forms.
Since operators can send scripts through C2 infrastructure, they can alter behavior without releasing a new version of the app, integralads said.
IAS confirmed the operation through a server-controlled test mode found in the WebViewOut worker. When enabled, the mode brings a normally hidden webview to the foreground.
This allowed researchers to directly observe pages scrolling, elements being clicked, and consent forms being handled automatically in real time.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
