If one can trust the statistics, botnet-based clickfraud is, because of a piece of malicious click fraud software known as ClickBot.A, at an all-time high. This week the Inside AdWords Blog wrote an interesting article about it and also seoscoop, along with many other blogs, covered the topic.
It is said that a white paper on ClickBot.A`s modus operandi was created by Neil Daswani and Michael Stoppelman of the Google click quality team. The little bot can generate fraudulent clicks on Google Ads to generate income for it`s creator. As you can imagine, making a lot of money with Google always pulls a human evaluation. This is why  ClickBot.A used a more “low noise” technique toattack. No huge number of clicks were being generated. No, ClickBot.A ha a very slowly growing click rate which is reminiscent of real user activity on quality websites. An attack of this type is very difficult to spot and to stop.
 
But it get`s even better. Clickbot.A uses syndicated search engines and does not directly attack Google. The bot targeted only sponsored links on pages of smaller search engines of companies like Ask or AOL. The final clue is that an end user publisher sub-syndicates these adverts to display  them on their own websites. This can be done through displaying Adsense Ads via one of Google’s partner companies which were not mentioned.
 
In the final step, the size of the botnet is of essence. The Bot Master, who has a network of zombie machines (each with their own IP), all with a plugin/ software installed for example on Microsofts Internet Explorer, sends these machines to create fraudulent clicks and therefore income for the Bot Master.
 
Of course Google, with a threat to the AdWords/ AdSense like this, Google`s highest priority is to get the guys behing Clickbot.A to protect their customers & clients:
 
"In the last year, you've probably read a lot about how Google not only manages the issue of click fraud, but also protects our advertisers against the many ways in which criminals attempt click fraud - including clicking on ads themselves, hiring low-cost workers to click on ads all day, and "high-tech" approaches such as botnets (i.e. a collection of software robots, or bots, which run autonomously)."

Google says that all invalid clicks performed by this particular bot, and they are all invalid(!), are captured by the search engine’s filtering systems. They dissected the clickbot and published their results last week to educate the wider security community on the threats posed by these types of attacks. On the contrary: The general opinion thoughout the blogs and forums in the black-hat community say the situation is even worse. And to be honest, that is what I believe, too. You should try to keep your Adsense spendigs moderate and under constant control.