Slop, Meet Fraud: Building a Shared Defense (Part 1 of 2)

The thing keeping marketers up at night about AI isn’t deepfakes or disinformation. It’s SpongeBob.

That’s the framing Digiday used in October 2025, and it captured something real: the cartoon became an unlikely mascot for a flood of AI-generated video blurring the lines between parody, harmless fun, copyright infringement, and outright deception. There’s no single SpongeBob scandal; that’s the point. AI-generated content now sits on a sliding scale from harmless to harmful, and marketers are struggling to identify and communicate real threats.

Less than a year later, the harmful end of that scale has a price tag. And it’s being paid, unknowingly, by advertisers.

For organizations like AdTechCares and the Defending Against Deception Common Data Model (DAD-CDM) project, this is both a crisis and an opening, because the problem isn’t only detection. It’s that the industry has no shared language for describing the threat, and therefore no coordinated way to respond to it. A critical element to ensure cross-sector coordination is the adoption of a standard framework.

The scale of the problem

In June 2026, DoubleVerify’s Fraud Lab exposed a scheme it named “DreamScheme”: AI-generated “girlfriend ads” promising users a customizable virtual companion. The click never leads anywhere real. It routes through a chain of made-for-advertising (MFA) sites stuffed with fake search results and legitimate brand ads, siphoning money away from real publishers at every hop. Some of the lures use suggestive, AI-generated depictions of recognizable (and copyrighted) animated characters from popular family films. It is the same slide from parody to harm that Digiday flagged, now fully monetized.

The numbers, as reported by Digiday:

• DreamScheme drew over 2 million visits per month in Q1 2026 across mobile apps and websites, with traffic from the US, UK, Brazil, and France.
• A single network can generate revenue in the low hundreds of thousands annually; DoubleVerify estimated the global economic impact of this fraud type could reach millions.
• AI slop domains on the block list maintained by intelligence platform Deepsee.io more than doubled in a year, from 96,791 in May 2025 to 221,194, and now make up about 90% of its 243,853 blocked MFA and slop domains, according to co-founder and CEO Rocky Moss.

DreamScheme isn’t an isolated case. In March 2026, DoubleVerify uncovered “AutoBait,” a network of more than 200 AI-generated sites posing as independent lifestyle blogs, producing clickbait for as little as $2.25 a page and capturing tens of millions of ad impressions. The operators accidentally left their AI prompts exposed in the page code, and those prompts are the tell. The system was instructed to produce hyper-realistic images that should, in its own words, “NOT look artificial, stylized, or…generated by AI.” Deception wasn’t a side effect. It was the spec.

This is the shift. As Axios noted in its coverage, scam sites predate AI, but AI has collapsed the cost and time needed to scale them. The result is what one DoubleVerify researcher described to Digiday: a system engineered for the highest possible level of manipulation, churning out fresh content every few hours so the same person can be caught more than once.

The missing piece: a shared language

Detection tools exist. DoubleVerify has AI SlopStopper, IAS has its own, and Zefr has built proprietary models to flag AI slop at scale and track it continuously inside live campaigns. Many of these vendors are very good at it. But when a scheme like DreamScheme runs across YouTube, mobile apps, and display networks at once, each platform and each vendor is fighting it alone.

That’s the case for a shared standard even from the vantage point of the companies with the best detection: a proprietary model catches what it catches, but a common framework is what lets those catches travel across the rest of the ecosystem. Detection is a competitive edge; a shared language is a collective one. The industry needs both.

The deeper gap is structural. The industry lacks a common terminology for describing online deception. Without a shared way to name a tactic, a channel, or a narrative, a coordinated response is impossible. Every actor is solving the same puzzle in a different language, and detection signals don’t travel between them. A standardized framework is what lets defenders work together instead of in isolation.

This is exactly what DAD-CDM is built to provide. An OASIS Open Project, it extends the STIX cybersecurity standard, the same machine-readable language that enterprises and governments already use to share cyber threat intelligence. DAD-CDM brings that approach to the world of deception. Crucially, it’s not a detection product or a content-moderation service. It’s the connective tissue that lets detection products talk to each other.

A cautionary tale: what happens without a neutral standard

The advertising industry has tried shared frameworks before, and the most prominent one is now gone in a way that’s instructive.

The Global Alliance for Responsible Media (GARM), a World Federation of Advertisers initiative launched in 2019, built common definitions for brand safety, including a Brand Safety Floor that added “misinformation” as a harmful-content category in 2022. The common-language approach worked: WFA reported that ads supporting harmful and illegal content fell from 6.1% in 2020 to 1.7% in 2023.

But in August 2024, WFA discontinued GARM. The shutdown came days after X filed an antitrust lawsuit alleging the group had organized an advertising boycott, and followed a US House Judiciary Committee report accusing members of colluding to demonetize certain viewpoints. WFA said the allegations had drained the initiative’s resources and made continuing untenable. As we’ll cover in Part 2, the regulatory story didn’t end there.

The lesson isn’t that shared frameworks are doomed; it’s which kind survives. GARM made judgments about which content was acceptable, and those judgments became a target. DAD-CDM is deliberately different: it doesn’t decide what’s true, doesn’t rank viewpoints, and doesn’t tell anyone what to block. It standardizes how deception is described so defenders can coordinate and make their own decisions. In a contested environment, neutrality isn’t a limitation; it’s the point.

What a structured response could look like

Imagine if AdTechCares’ coalition members, including DoubleVerify and others among its 50+ companies, could leverage DAD-CDM to:

1. Describe deception consistently. Instead of each vendor maintaining a proprietary taxonomy, the ecosystem could share standardized objects describing generation method (synthetic, manipulated, human), distribution pattern, source transparency, and impersonation markers. DAD-CDM’s proposed STIX extensions already include objects for Channels, Narratives, and Media Outlets. A “Channel” is a defined conduit for information (a page, a feed, a redirect chain), precisely the structure a scheme like DreamScheme exploits.
2. Share intelligence at machine speed. When one member flags a DreamScheme variant, that signal could propagate to every other member in a STIX-compatible format. A network attempting to monetize across platforms could be recognized once, with each member deciding how to act under its own policies, in minutes rather than weeks.
3. Coordinate, not just detect. As Channel Factory’s chief product officer told Digiday, the decision about AI-content adjacency should hinge on signals like believability, virality, and contention, independent of whether content is AI-made. DAD-CDM could standardize how those signals are expressed and exchanged, turning isolated vendor calls into a shared risk picture.
4. Measure impact collectively. AdTechCares has delivered billions of PSA impressions. Pairing that reach with structured measurement would let the coalition track not just how much authentic content was served, but how much spend was diverted away from fraudulent networks across the ecosystem.

This isn’t theoretical. DAD-CDM’s model is already informing the work of counter-deception bodies in civil society and government like Debunk.org, the European External Action Service, and France’s VIGINUM, which use STIX-based tooling to connect the dots across investigations. Bringing the adtech ecosystem into that same standard would extend the defense to where much of the money, and therefore much of the incentive, lives.

Describing deception, not deciding truth

The strength of DAD-CDM’s approach is that it focuses on observable, technical indicators rather than adjudicating what’s true:

• Is the content what it claims to be? (authenticity)
• Does it rely on manipulated or synthetic media presented as real? (technical deception)
• Is the source and its distribution transparent? (attribution)
• Is it engineered to mislead by design? (intent, as AutoBait’s own prompts revealed)

These are largely questions of mechanics, and mechanics travel well across a fractured ecosystem. A redirect chain built to launder ad-spend is a redirect chain no matter who runs it. An image instructed to hide that it’s AI-generated is deceptive by its own admission, regardless of subject.

That’s not to claim the harder questions vanish. Whether a given piece of content is “misleading” can be genuinely contested, and real-world deception rarely reduces to a clean true-or-false verdict. That’s exactly why a standard should describe what can be observed and shared (the synthetic origin, the coordinated distribution, the concealed intent) rather than asking the industry to agree on a single verdict about meaning. Describe the mechanics, and defenders can coordinate even when they’d disagree about interpretation.

A path forward

The pieces fit together:

• DAD-CDM brings the open standard and the technical framework for describing deception in a shared language.
• AdTechCares brings the coalition, the reach, and a membership that already includes the verification firms on the front line.
• The advertising industry brings the budgets that schemes like DreamScheme and AutoBait are built to drain, along with the clearest possible incentive to stop them.

When Digiday asked about timing in October 2025, Zefr’s chief commercial officer predicted brands would start writing AI-content policies into their campaigns from early 2026. Whether or not those policies have been formalized everywhere, the concern is clearly there: a December 2025 IAS survey found 56% of UK media professionals expect AI-generated content adjacency to be a major challenge for the year, with half citing ad fraud and MFA content as a media quality concern. The open question is whether the industry’s response will be fragmented and proprietary, or built on a shared, neutral standard that lets the whole ecosystem defend itself at once.

Detection alone will always be a step behind operators who can release fresh content in hours. Coordination is how defenders close the gap, and coordination starts with a common language.

Coming in Part 2: new data on how far AI slop has spread, a shifting vendor landscape, and what recent regulatory action means for any shared framework in advertising.

About DAD-CDM: The Defending Against Deception Common Data Model is an OASIS Open Project creating open standards to capture, analyze, and exchange threat data relating to deception across sectors and borders. Learn more or contribute on GitHub.

About AdTechCares: AdTech Cares uses digital advertising infrastructure and donated media inventory to support critical public service announcements (PSAs.) It connects media owners, publishers, and ad tech platforms to donate ad space and resources for societal benefit. AdTechCares is a member of DAD-CDM.

Would you like to explore how your organization could contribute to this effort? Contact DAD-CDM or AdTechCares.

Sources

• Digiday, “Marketers confront a new kind of brand safety problem in AI video” (Oct 24, 2025)
• Digiday, “AI ‘girlfriend ads’ are fueling a new wave of MFA sites” (Jun 11, 2026)
• DoubleVerify, “Fraud Alert! AI Slop ‘Dream Girls’ Are an Advertiser’s Nightmare” (DreamScheme)
• DoubleVerify, “Introducing DV’s AI SlopStopper for Social” (Apr 16, 2026)
• DoubleVerify, “DV Exclusive: Inside an AI Slop Factory” (AutoBait, Mar 4, 2026)
• Axios, “Fraudsters create 200+ AI slop websites in one operation” (Mar 4, 2026)
• PPC Land, “DoubleVerify exposes AutoBait” (industry stats: ANA, IAS)
• IAS, “Cut the AI Slop: IAS Low-Quality GenAI Avoidance Is Now Live” (May 29, 2026)
• The Drum, “How Zefr is using AI to fight AI inside the walled gardens” (Apr 2026)
• PPC Land, “UK advertisers brace for AI content chaos” (IAS 2026 UK Industry Pulse Report)
• DAD-CDM: project site, GitHub, governance repo, STIX extensions post, launch announcement, FAQ
• OASIS, STIX documentation
• WFA, “WFA discontinues GARM” (Aug 9, 2024)
• Campaign US, “GARM’s discontinuation ‘sad day for industry'” (Aug 2024)