VexTrio Viper

VexTrio Viper is a long-running cybercriminal traffic distribution system (TDS) and malicious adtech ecosystem active since at least early 2020, with reporting indicating broader operations spanning nearly a decade. It operates one of the largest known affiliate-driven criminal traffic brokerage programs, routing compromised or fraudulently acquired web traffic to dozens of downstream partners for scams, phishing, malware delivery, fake applications, gambling, dating fraud, and other harmful content. Known associated entities include Los Pollos, a malicious advertising technology operation described as operating under the VexTrio Viper umbrella, and affiliates such as GoRefresh. Reporting also links the ecosystem to affiliates including SocGholish and ClearFake. A defining feature of VexTrio Viper is large-scale web traffic monetization through redirection chains, device and geolocation profiling, and push-notification abuse. The actor has been observed redirecting victims through multi-stage TDS infrastructure, often using fake CAPTCHA-style prompts to induce users to enable browser push notifications. Those notifications are then used to drive persistent scam traffic, including scareware, fake giveaways, fraudulent surveys, fake dating sites, fake applications, adware, disinformation, and occasional malware delivery. The infrastructure tailors payloads to the victim environment and can chain through multiple TDS layers to evade detection and maximize affiliate revenue. VexTrio Viper has also been tied to malicious mobile applications published through official Apple and Google app storefronts while masquerading as legitimate utility software. In addition, the actor has used compromised websites and hijacked domains to feed its TDS infrastructure. Since early 2020, VexTrio Viper has been observed exploiting the Sitting Ducks domain-hijacking technique to take over registered domains through weaknesses in DNS and hosting workflows, allowing the actor to repurpose legitimate domains for redirection, phishing, scams, and malware-related activity while benefiting from the trust and reputation of those domains. The ecosystem is notable for its scale, resilience, and service-based criminal model. It functions as a central broker of malicious traffic for a broad affiliate network rather than a single-purpose malware crew. Its operations emphasize initial victim acquisition, traffic filtering, redirection, scam delivery, and defense evasion through layered infrastructure and profiling. Available evidence supports a primarily financially motivated actor.