Researchers: Jou Kim, Francis Kitrick, Joao Marques, Will Herbig, Adam Sell
IVT Taxonomy: Misleading User Interface
HUMAN’s Satori Threat Intelligence and Research Team has identified a collection of 180 mobile apps (on both Android and iOS) that mislead users with the promise of cash rewards for playing games, while limiting the ability of users to withdraw funds earned, generally through gameplay that’s impossible to complete. Researchers have dubbed this operation Phantom Payout, reflecting the difficulty users have in earning or collecting prizes promised by the apps. Android apps associated with this operation have been downloaded more than 21 million times (most through unofficial marketplaces), and iOS apps more than 55,000 times.
Apps associated with this threat lure unsuspecting users into downloading and playing the games, and subsequently entice users with in-app purchases that claim to help users complete difficult levels or accelerate rewards, but which still don’t result in payout opportunities.
Additionally, these apps are further monetized through in-game ads, to the tune of 500 million bid requests globally over a 30-day span in fall 2025, peaking at 25 million bid requests a day. Ads on these apps are considered invalid because of the apps’ misleading claims about receiving rewards.
Researchers have reported apps associated with Phantom Payout to their respective marketplaces, as of March 4th 2026, 109 Android apps and all iOS apps are no longer available on official marketplaces. Customers partnering with HUMAN for Ad Fraud Defense and Ad Click Defense are fully protected from this threat.
Global distribution of Phantom Payout-related bid requests
Technical Evidence
Apps associated with this threat generally share several characteristics with one another:
All of the monetized apps share a single seller domain: game.adsgreat[.]cn. This domain is login-protected, but researchers found connections between adsgreat and 6686 Sports, a Chinese sportsbook that has been reported to enable piracy of sports streams.
The adsgreat homepage features prominent 6686 branding, and the JavaScript referenced in the second flow in the list, when executed, connects links on the seller domain to a page with additional 6686 branding.
Example iOS App
Above, the developer page for a Phantom Payout-associated app, bundle ID 6742401306. As is common with apps associated with this threat, this is the only app published by this developer. The email associated with this developer is a formulaic free email address, no developer website is listed, and the privacy policy for the app is a generic one generated by a free policy creator.
The collected user ratings for this app show a telltale “C curve”, with the distribution of ratings overwhelmingly falling on 1 and 5. In earlier Satori research, this C curve indicated some fake positive ratings intended to boost the app’s popularity, while the negative ratings are legitimate poor responses from users.
In the case above, the top ratings suggest user frustration with an inability to meet the threshold for a payout, even after additional money was spent within the app.
Example Android App
Above, the Play Store listing for Tile Mahjong: Money Win, published by Uprising Games. As with the example iOS app, this is the only app from that publisher. Note that the download count for this game exceeds 500,000, and that the app has a “mature” rating for offering cash rewards.
The privacy policy link for this app leads to a generic, template-based policy, and both the support and developer emails are on free, non-corporate services.
Notice the design in the promo images for the app, including the suggestion of possible earnings from the game.
Above are promotional images for three other Phantom Payout-associated apps. Notice the similarity in design for the images. Two of them, Scenery Tile: Earn Money Game and Lovely Flower Basket: Match have identical promotional images, though they have different developers and support information.
Ratings and reviews for these games are similar to the ratings and reviews for the iOS game shown above.
Conclusion
Users with any Phantom Payout-associated apps should remove the games from their devices; the promised payouts are unlikely to occur. Customers partnering with HUMAN for Ad Fraud Defense and Ad Click Defense are protected from the impacts of Phantom Payout.