--- title: How we uncovered millions of dollars in mobile app fraud description: Pixalate has identified a significant example of mobile app fraud that relies heavily on fraud spoofing, or Bundle ID spoofing specifically. This is how we identified the mobile ad fraud and estimate that the potential loses could be costing advertisers over $75 million per year. image: https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/megacast-play-store-screenshot.png --- [![pixalate-full-logo](https://www.pixalate.com/hs-fs/hubfs/Pixalate_Logos/pixalate-full-logo.jpg?width=150&height=60&name=pixalate-full-logo.jpg "pixalate-full-logo")](https://www.pixalate.com) Search **Menu** ** ** ![](https://www.pixalate.com/hubfs/Blog_Media/Blog%20photos/megacast-play-store-screenshot.png) [Mobile](https://www.pixalate.com/blog/topic/mobile) | [Investigations](https://www.pixalate.com/blog/topic/investigations) | 8 min read # How we uncovered millions of dollars in mobile app fraud Written by [Tyler Loechner](https://www.pixalate.com/blog/author/tyler-loechner) Jun 12, 2018 10:00:57 AM Pixalate monitors and prevents 38 major types of invalid traffic (“IVT”), and there are times when we detect specific examples of sophisticated IVT that appear concrete and offer the opportunity to bring to light how fraud can work within the programmatic ecosystem. In this case, Pixalate identified what we believe is a significant example of [mobile app laundering](https://www.pixalate.com/mobile-ad-fraud-what-is-mobile-app-laundering-sivt) that relies heavily upon Bundle ID spoofing. Laundering has been a growing problem in the mobile app space over the past 12 months, and it has become one of the most prevalent types of ad fraud. Based on Pixalate’s data and research, this particular finding — which is linked to a single app — could be costing advertisers over $75 million per year, and several major brands may have been exposed. Our research discovered that the MegaCast - Chromecast Player application appears to receive encrypted information from a third-party vendor called MobiAsset, which we believe serves as a catalyst for the mobile app laundering. MegaCast then links to a third-party vendor, called Mobilytics, as part of the ad call.  From the information communicated through Mobilytics, the inventory identification appears to have changed and is no longer MegaCast but, instead, references one of more than 50 identified applications, such as Lucky Jelly Puzzle or Survival Island: Primal Land. This laundering, which looks to us like an example of IVT where the advertiser believes they are buying inventory on one of the 50+ identified applications, but, instead, the ads may “render” in a dark screen or a background process which is not visible. [Mobilytics.org](http://mobilytics.org/) (*not to be confused with Mobalytics or Mobalytics.gg*) positions itself as a mobile app analytics platform. Mobilytics and MegaCast list the same address in Malta as their location. ### **See the apparent mobile app laundering via Bundle ID spoofing in action** MegaCast - Chromecast Player (Bundle ID: com.mega.cast) is the app in question. Here is a video captured by the Pixalate analyst team detailing the apparent mobile app laundering in action: ### **Information about MegaCast - Chromecast Player** The MegaCast - Chromecast Player app (referred to as “MegaCast” for the rest of this article) is an Android![megacast-play-store-screenshot](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/megacast-play-store-screenshot.png?width=300&name=megacast-play-store-screenshot.png) application available via the [Google Play Store](https://play.google.com/store/apps/details?id=com.mega.cast&hl=en_US). Here is a high-level explanation of what the app purports to do, extracted from their Google Play Store profile page: *"It is the first Chromecast player with real time transcoding support. It goes ever further than the possible [sic], and it CAN even PLAY files that Chromecast doesn’t support."* The app has over 1,000,000 (1 million) downloads, according to the Google Play Store. Its average user rating is 4 stars. ### **This finding could be costing mobile app advertisers over $75 million per year** To get a sense of the potential revenue impact, we tracked activity across devices that had MegaCast installed. Here’s what we found: - If the device is on for 24 hours, 1,400 impressions are served to the device per day (about 1 ad per minute) - The laundered impressions are about 60% display and 40% video   Based on conservative estimates, we believe this discovery could be costing advertisers at least $75 million per year. To see exactly how we arrived at this estimate, please [refer to this shared Google Sheets document](https://docs.google.com/spreadsheets/d/1jZVnMpuGKuj3LvrXXutoXwrxwdG5HUL4QWgC38bJNXc). ### **What is the invalid activity that appears to be taking place via the MegaCast mobile app?** There appear to be a handful of different scenarios at play here. These are the three primary activities that we believe are occurring: - Mobile app laundering: Laundering of a mobile app via Bundle ID spoofing is an example of IVT where the advertiser believes they are buying inventory on one mobile app, but instead, the ad is going to another “laundered” app (or potentially even just to a dark screen or background process). - Incentivized Automatic Activity: Ads are being served even if the app isn’t open (in the foreground). As soon as the phone turns on (even before it is unlocked) the MegaCast app appears to begin transacting ads in the background. - Incentivized Automatic Activity: Ads are being transacted even if the screen is off. As long as the phone is on — even if the screen is off — ads are still being transacted. This blog post focuses on the first scenario: Mobile app laundering. ### **A technical, step-by-step look behind the scenes of mobile app laundering via Bundle ID spoofing** We’ve extracted screenshots from the Charles Log to depict how the mobile app laundering takes place — and what that looks like. Note: The below steps appear to take place whenever a phone that has the MegaCast app installed is powered on; we believe the phone does not need to be “awake” and the MegaCast app does not need to be open in order for these processes to occur. - **Step 1: MobiAsset appears to ‘activate’ the Bundle ID spoofing activity** Shortly after the user’s phone is turned on, the app sends a request to MobiAsset; and MobiAsset responds with an encrypted message to the device which we believe serves as the “activation” of the Bundle ID spoofing activity. The below screenshot shows the encrypted message (you can also see this at the 1:04 mark in the video). ![mobiasset-encrypted-mobile-app-bundle-id-spoofing-alleged](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/mobiassets-encrypted.png?width=800&name=mobiassets-encrypted.png) The information is encrypted, but it is possible that this is transmitting up-to-date ad ops-related information to MegaCast, such as the construction of ad calls, what containers should be used, etc. It’s also possible that this encrypted message contains information on which Mobilytics Config IDs are available. Once it has all of the ad ops-related business squared away, the MegaCast app then begins communicating with Mobilytics, which brings us to Step 2: - **Step 2: Where the ad information is assembled … but the Config ID is changed** We believe MegaCast then requests Mobilytics for information on what Bundle IDs to represent, after compiling a list of advertisers and platforms that are interested in the available inventory. This step takes place prior to sending the information to the monetization platform. ![megacast-mobile-app-bundle-id-spoofing-alleged-config-id](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/megacast-call.png?width=800&name=megacast-call.png) As seen above, the App Name is MegaCast, which shows where this call is originating from. However, the Config ID has been changed to selfie_us_s5. - **Step 3: Requesting creatives for an impression … but now it looks like it’s coming from a different app** MegaCast appears to notify the specified platform that inventory is available, and that platform starts fielding bids for the apparently-laundered inventory. The spoofed apps linked to the Mobilytics Config ID can always be linked to the “App Name” or Bundle ID in the corresponding ad server request. In other words, the monetization platform (e.g., an SSP) thinks the inventory is coming from whatever app is being spoofed, even though it is still coming from MegaCast. All ties to MegaCast are scrubbed prior to the ad call reaching the monetization platform. ![megacast-mobile-app-bundle-id-spoofing-config-id-charles-log-alleged](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/megacast-response.png?width=800&name=megacast-response.png) As you can see above, the monetization platform now thinks they are monetizing an impression from New Selfie Expert PLUS (Bundle ID: com.adar.cameracantik). This is the associated app from the Config ID that was inserted as shown in Step 1. - **Step 4: The actual serving of the ad … to MegaCast (or to a dark screen, or to a background process) — but the advertiser doesn’t know that** After the ad call has been assembled (Step 1) and the request for creative has been completed (Step 2), then an advertiser buys the impression and the ad is served, potentially just to a black screen. The below is the associated Charles Log screenshot for this particular impression: ![megacast-bundle-id-spoofing-mobile-app-advertising-ad-fraud-alleged](https://www.pixalate.com/hs-fs/hubfs/Blog_Media/Blog%20photos/megacast-response-2.png?width=800&name=megacast-response-2.png) In this case, it was a video ad wrapped in a VAST tag. (This particular ad appears to have been for L’Oreal.) ### **Over 50+ apps appear to be used in the laundering  — and they aren’t necessarily random** The above screenshots show New Selfie Expert PLUS as the app that appears to be spoofed. Based on Pixalate’s observations, there are 50+ apps that appear to be utilized in the laundering, and the apps do not appear to be completely random. As seen in the Config ID that is changing upon ad calls (shown in Step 1 above), the app seems to be chosen specifically because it already has a relationship with the platform that goes on to monetize the ad. This could be done to reduce suspicion. For example, in the above screenshots, it is possible that “New Selfie Expert PLUS” was selected because MegaCast was looking for inventory that is popular with their buying platforms, brand-safe, and a commonly seen pathway. In selecting such apps, it may be less likely that any red flags would be raised. ### **Steps you can take to protect your business** - **Consider blocking these associated Bundle IDs**. Pixalate has made available for download (for free) a list of the top Bundle IDs that appear to be associated with this discovery. Blocking these Bundle IDs may help limit your exposure to this particular IVT event: [![thrive plus site list](https://no-cache.hubspot.com/cta/default/2364596/ac97d2ca-617a-4a12-80b8-d391e61ea84d.png)](https://cta-redirect.hubspot.com/cta/redirect/2364596/ac97d2ca-617a-4a12-80b8-d391e61ea84d) - **Apply pre-bid filters. **Pixalate monitors 38 major types of IVT, and we are constantly updating our pre-bid blocklists based on new discoveries. Monitoring IVT and blocking IVT are two different things. As this example appears to show, ad fraud events can be complex, widespread, and difficult to wrangle — even if they stem from just one app. You should partner with a company that has the requisite expertise and technology capable of identifying (and preventing) all types of IVT. If you are not applying pre-bid filters, you are leaving your business exposed to new threats. - **Utilize whitelists. **Depending on business objectives, whitelists may not be applicable in all scenarios, but it is extremely important to know which environments best meet your needs. Work with a company that makes it easy to research and identify trusted inventory sources. - **Keep tabs on Ads.txt adoption among mobile app publishers. **This apparent discovery comes at an important time for the mobile app landscape. In early June 2018, the IAB [released](https://iabtechlab.com/press-releases/iab-tech-lab-introduces-mobile-app-support-for-ads-txt/) its first guidance of mobile app support for Ads.txt, an initiative which aims to combat invalid activity and has been adopted by the [majority](https://www.pixalate.com/iab-ads-txt-q1-2018-trends-report) of major web publishers. - ****Continual monitoring of the ad ecosystem. **The advertising landscape, particularly mobile in-app, is ever-changing. With new apps, supply vendors, and buyers entering the ecosystem, consistent detection is critical for revenue, security, and privacy protection.** ### **Brands impacted** Facebook, Disney, and more were among the [brands impacted](https://www.pixalate.com/brands-impacted-by-megacast-apparent-mobile-app-laundering-spoofing-ad-fraud-ivt) by this discovery. This is a partial list, representing a snapshot of companies that we believe were victimized by the apparent invalid activity. You can [download our whitepaper](https://info.pixalate.com/brands-impacted-by-megacast-apparent-app-laundering) which shares network capture images as well as images of the creatives. ### **About Pixalate** Pixalate is a cross-channel fraud intelligence company that works with brands and platforms to prevent invalid traffic and improve ad inventory quality. We monitor 38 major types of invalid traffic, viewability, brand safety, and other media metrics in order to deliver a complete measurement platform that facilitates any buying or selling goal. Pixalate specializes in detailed in-app, OTT and display analysis by offering fraud analytics for precise detection, pre-bid blocklists for custom prevention, and media ratings for media planning and review.  *Want more data-driven insights? Sign up for our blog! * ### Search Blog Search ### Follow Pixalate ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) Previous Story [← Pixalate Week in Review: June 4 - 8, 2018](https://www.pixalate.com/blog/programmatic-ad-fraud-news-week-in-review-june-8-2018) [** ](https://www.pixalate.com/blog) Next Story [Which-50: 'Pixalate Says It Uncovered ‘Sophisticated’ Android Ad Fraud Potentially Worth $75 Million Annually' →](https://www.pixalate.com/blog/which-50-megacast-mobile-app) ## You May Also Like These Stories on Mobile [![](https://www.pixalate.com/hubfs/Blog%20Media/2026%20Covers%20and%20Images/OpenEPG%20landing%20page%20hero%20image.png) ](https://www.pixalate.com/blog/pixalate-launches-openepg-1.0-analytics-to-bring-linear-tv-grade-measurement-verification-to-open-programmatic-ctv) [Mobile](https://www.pixalate.com/blog/topic/mobile) ### [Pixalate Launches OpenEPG™ 1.0 Analytics to Bring Linear TV-Grade Measurement & Verification to Open Programmatic CTV; OpenEPG DB™ Unlocks 12,875 Shows From 318 Channels Using Bidstream Bundle ID](https://www.pixalate.com/blog/pixalate-launches-openepg-1.0-analytics-to-bring-linear-tv-grade-measurement-verification-to-open-programmatic-ctv) Jun 16, 2026 8:33:30 AM | 5 min read [![](https://www.pixalate.com/hubfs/Blog%20Media/2026%20Covers%20and%20Images/United%20States%20%26%20GLOBAL%20-%20IVT%20Benchmarks%20-%20Q1%202026.png) ](https://www.pixalate.com/blog/q1-2026-ad-fraud-benchmarks-report-for-north-america) [Mobile](https://www.pixalate.com/blog/topic/mobile) ### [Pixalate Releases Q1 2026 North America Invalid Traffic (IVT) & Ad Fraud Benchmarks: United States Mobile Apps See 32% Invalid Traffic (IVT) Rate](https://www.pixalate.com/blog/q1-2026-ad-fraud-benchmarks-report-for-north-america) Apr 29, 2026 8:00:01 AM | 2 min read [![](https://www.pixalate.com/hubfs/Blog%20Media/2026%20Covers%20and%20Images/UNITED%20KINGDOM%20%26%20GERMANY%20%26%20GLOBAL%20-%20IVT%20Benchmarks%20-%20Q1%202026.png) ](https://www.pixalate.com/blog/q1-2026-ad-fraud-benchmarks-report-for-emea) [Mobile](https://www.pixalate.com/blog/topic/mobile) ### [Pixalate Releases Q1 2026 EMEA Invalid Traffic (IVT) & Ad Fraud Benchmarks: United Kingdom Connected TV (CTV) Most at Risk with 46% IVT Rate](https://www.pixalate.com/blog/q1-2026-ad-fraud-benchmarks-report-for-emea) Apr 29, 2026 8:00:00 AM | 2 min read ** ### Subscribe to our blog *By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use ](https://www.pixalate.com/terms)and [Privacy Policy.](https://www.pixalate.com/privacypolicy) ![pixalate-logo-red-small](https://www.pixalate.com/hs-fs/hubfs/2018NewTemplate/pixalate-logo-red-small.png?width=208&name=pixalate-logo-red-small.png "pixalate-logo-red-small") ** By entering your email address and clicking Subscribe, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy) Products [Analytics](https://www.pixalate.com/products/analytics) [Blocking](https://www.pixalate.com/products/blocking) [Media Rating Terminal](https://www.pixalate.com/products/mrt) [Publisher Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [Seller Trust Indexes](https://www.pixalate.com/rankings/?group=app&reportId=publisherTrustIndex) [IoT Device Rankings](https://www.pixalate.com/rankings/?group=app&reportId=iotDeviceReach) Resources [Blog](https://blog.pixalate.com/) [Press](https://www.pixalate.com/press) [Careers](https://www.pixalate.com/jobs) [Team](https://info.pixalate.com/pixalate-leadership-team) Contact Email [** sales@pixalate.com ](mailto:sales@pixalate.com) [** privacy@pixalate.com ](mailto:privacy@pixalate.com) US: [** +1 888 749 2528 ](tel:+1%20888%20749%202528) EU: [** +44 (0)800 011 2050 ](tel:+44%20(0)800%20011%202050) Slack: [Join ATSAPI Slack Channel ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) Offices Global Offices US 1775 Greensboro Station Place, Suite 425, McLean, VA 22102 UK 20 North Audley Street London, W1K 6WE, United Kingdom EU 10 Earlsfort Terrace Dublin 2, D02 T380, Ireland Singapore 10 Anson Road, #22-02 International Plaza, Singapore 079903 [![facebook](https://www.pixalate.com/hubfs/footer/icons/facebook.png) ](https://www.facebook.com/pixalate) [![x](https://www.pixalate.com/hubfs/footer/icons/twitter-x.png) ](https://twitter.com/pixalateinc) [![linkedin](https://www.pixalate.com/hubfs/footer/icons/linkedin.png) ](https://www.linkedin.com/company/pixalate) ![wechat](https://www.pixalate.com/hubfs/footer/icons/wechat.png) [![slack](https://www.pixalate.com/hubfs/footer/icons/slack.png) ](https://atsapi-pixalate.slack.com/join/shared_invite/zt-10dtow5cj-OEtlNr5yzJkrZMQUqcEEow#/shared-invite/email) [Terms of Use](https://www.pixalate.com/terms) [Privacy Policy](https://www.pixalate.com/privacypolicy) [GDPR Compliance](https://www.pixalate.com/gdpr) Disclaimer Copyright © 2025 Pixalate [Back to top **](https://www.pixalate.com/blog/mobile-app-laundering-bundle-id-megacast-alleged-sophisticated-invalid-traffic-ad-fraud#) # Disclaimer Disclaimer: The content of this page reflects Pixalate’s opinions with respect to the factors that Pixalate believes can be useful to the digital media industry. Any proprietary data shared is grounded in Pixalate’s proprietary technology and analytics, which Pixalate is continuously evaluating and updating. Any references to outside sources should not be construed as endorsements. Pixalate’s opinions are just that - opinion, not facts or guarantees. Per the MRC, “'Fraud' is not intended to represent fraud as defined in various laws, statutes and ordinances or as conventionally used in U.S. Court or other legal proceedings, but rather a custom definition strictly for advertising measurement purposes. Also per the MRC, “‘Invalid Traffic’ is defined generally as traffic that does not meet certain ad serving quality or completeness criteria, or otherwise does not represent legitimate ad traffic that should be included in measurement counts. Among the reasons why ad traffic may be deemed invalid is it is a result of non-human traffic (spiders, bots, etc.), or activity designed to produce fraudulent traffic.” ** ** *By clicking Download and entering your email address, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and have read and acknowledge our [Privacy Policy](https://www.pixalate.com/hubfs/2024-08-20_Pixalate_Privacy_Policy.pdf). *Copyright © 2025 Pixalate** * * * * * * * * * * * * * * * * * * * * * * * * * * * * × ## Subscribe to the Pixalate Blog The first step in ad fraud prevention. Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Contact Us12 Loading... ![pixalate-logo-white](https://www.pixalate.com/hubfs/Blog_V2_08_26_2016/logo/Pixalate_Logo_WHITE.png) ##### Download GSTI Loading... Schedule your demo today Please complete all fields Loading... By entering your email address and clicking Submit, you are agreeing to our [Terms of Use](https://www.pixalate.com/terms) and [Privacy Policy](https://www.pixalate.com/privacypolicy). * * * * *