Loading threat actor…
LosPollos is a malicious affiliate advertising network associated with the VexTrio traffic distribution ecosystem. It has been used to funnel web traffic from compromised websites into scam, phishing, and malware-delivery chains through JavaScript-heavy smartlinks and related redirection infrastructure. The operation has been linked to affiliate-driven monetization schemes involving dating offers, sweepstakes, bait-and-switch mobile applications, financial scams, and malware download destinations. LosPollos has been observed embedded on hacked WordPress sites, where injected code redirects a portion of visitor traffic into VexTrio-managed distribution paths. It has also been tied to broader malicious ad-tech activity overlapping with push-notification abuse, deceptive CAPTCHA lures, and cloaking infrastructure used to evade moderation and detection. Reporting has linked LosPollos and the related TacoLoco network to entities registered in Switzerland, the Czech Republic, and Russia, and to infrastructure and business relationships overlapping with Russian-linked malicious traffic distribution and push monetization programs. LosPollos is not primarily described as a ransomware actor or nation-state intrusion set. Its role is best characterized as financially motivated malicious ad-tech and traffic brokerage that supports downstream scam and malware operations. Known associated names in reporting include lospollos, LosPollos, TacoLoco, VexTrio, and Adspro Group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious adtech/traffic monetization entity that Detour Dog previously supported by forwarding traffic (prior to Detour Dog’s observed shift into direct malware distribution).
LosPollos is an advertising network that uses hacked websites and smartlinks to funnel traffic into VexTrio's TDS, monetizing through scams, malware, and deceptive advertising.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.