“StreamScam” Operation Involved 28.8 Million U.S. Households, Including Approximately 3,600 Apps and 3,400 CTV Devices.

Oracle announced the discovery of “StreamScam,” the largest known connected television (CTV) ad fraud operation exposed ever. The StreamScam operation exploited flaws in CTV ad serving technology to fool advertisers into paying for ads that were never delivered to households. The operation spoofed more than 28.8 million U.S. valid household IP addresses, including approximately 3,600 apps and 3,400 unique CTV device models. The usage of valid household IP addresses demonstrates the sophistication of StreamScam compared to previous CTV ad fraud operations. By comparison, the largest prior CTV ad fraud operation had been ICEBUCKET, which involved two million spoofed household IP addresses, 300 app IDs, and 1,000 CTV device IDs.

StreamScam perpetrators capitalized on vulnerabilities in the technology used to improve the video viewing experience in CTV. Known as Server-Side Ad Insertion (SSAI), the technology combines content and ads into a single video stream that can play seamlessly with no delays on end-user devices, such as Roku, AppleTV, and FireTV.

“Sophisticated invalid traffic (SIVT) detection technology has been critical for us in the fight against ad fraud,” said Jim Keller, EVP Digital Sales and Advanced Advertising, Discovery, Inc. “Oracle Moat has helped us, and our clients, detect invalid traffic, track viewability and most importantly, protect media spend.”

To help educate and inform the broader industry of the StreamScam discovery and discuss mitigation, TAG and Oracle will be holding an industry briefing for TAG members in January 2021. TAG members will receive access to actionable information from Moat to help identify StreamScam in their data and avoid campaign fraud. Companies should also work with their agencies and technology partners to determine the impact of the fraud. Moat customers can contact their client representative to get additional information.