Loading threat actor…
WickedWally is a scam operation associated with large-scale abuse of advertising-tracker infrastructure to deliver deceptive campaigns to U.S. seniors. The cluster is known for using topical social-engineering lures centered on debt relief, grocery allowances, Medicare benefits, and funeral-expense assistance. Its campaigns use AI-generated deepfake video advertisements styled to resemble legitimate news reporting and tied to current events in order to increase credibility and conversion. Operationally, WickedWally uses cloaked traffic-routing infrastructure to selectively present content to victims while hiding malicious behavior from reviewers and intermediaries. Victims are funneled from ads and other traffic sources to fake chatbot experiences that claim to determine eligibility for nonexistent benefits, after which they are transferred to call centers that solicit personal and financial information. The broader ecosystem in which WickedWally operates has been observed using programmatic advertising, spam, social media, and compromised websites for traffic acquisition, along with rapid domain rotation and standardized lead-generation workflows. WickedWally appears to be financially motivated and focused on fraudulent lead capture and social-engineering-based theft rather than malware deployment or ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.