Adware

Adware usually comes bundled with free software or an extension. Once running, it can insert ads into pages the user visits, open new tabs or pop-ups, swap links, or send the browser to a monetised search page. Google's list of invalid activity includes ad injection (ads inserted without the publisher's knowledge) and malware that generates hidden or injected traffic.

For search arbitrage, adware is a traffic source nobody admits to. The visits come from real people on real devices, which makes them look genuine. But the person never chose to arrive, so they leave at once or click in confusion. The MRC standards list adware and malware activity as SIVT, and AdSense policies bar traffic from unwanted software applications.

Signs that a source is adware-driven: visits that open in a new tab with no upstream page, the same lander opened repeatedly on one device, very short sessions, and a spread of visitors across unrelated interests with no targeting logic.

Arbitrageurs defend themselves by refusing unexplained "redirect" or "contextual" inventory, monitoring per-source behaviour and using IVT detection that recognises injected sessions.

Think of it like this

It is a lodger who secretly rents out your front window for posters and keeps the money, while you wonder why strangers keep stopping outside.