pushtorm

Pushtorm is a push-notification advertising and traffic-monetization service associated with the malicious traffic distribution ecosystem surrounding VexTrio and related adtech networks. It enables website operators to subscribe visitors to browser push notifications, send targeted messages, and monetize traffic, including resale of excess traffic. Available reporting indicates it is heavily used by Rich Audience and may be controlled by that entity, but that control relationship is not established at high confidence. Within the broader malicious adtech ecosystem, services of this type have been used to route victim traffic from compromised websites into push-notification abuse chains and other monetized redirection flows. The surrounding ecosystem has been linked to large-scale compromises of websites, especially WordPress sites, and to techniques including server-side redirects, fake CAPTCHA lures, DNS-based command-and-control for redirect instructions, and browser push-subscription abuse. Closely related traffic distribution and push-advertising operations in this cluster have shown code, infrastructure, and operational overlap, with a strong Russian nexus reported across hosting, registration patterns, and affiliated services. Pushtorm should be understood as part of a commercialized push-advertising environment that can facilitate malicious traffic routing, user deception, and downstream malware or scam delivery, rather than as a clearly delineated standalone intrusion group. High-confidence attribution of specific sub-groups, victimology, or independent operational leadership beyond its association with Rich Audience is currently not available.