Loading story…
Infoblox researchers reported that a large-scale scam push-notification operation targeting primarily Android Chrome users was partially exposed after the threat actor made a DNS configuration error that left domains in a lame delegation state (a “Sitting Ducks” condition). By legitimately re-claiming an abandoned actor-controlled domain at its DNS provider—without accessing victim devices or the attacker’s servers—the researchers redirected notification and tracking traffic to infrastructure they controlled, gaining a live view of the criminal ecosystem behind the deceptive browser-notification spam.
Telemetry collected from victim browsers included rich JSON-style request data (e.g., device and locale details, lure text, and click behavior) and showed sustained, high-volume abuse: users could receive 100–140+ notifications per day for extended periods, with lures ranging from fake security alerts to gambling and adult content. Reporting indicates the researchers expanded collection from a single domain to nearly 120 domains, capturing tens of millions of records (including a cited figure of ~57 million logs over two weeks) and observing global activity across 60+ languages, with traffic heavily concentrated in South Asia (notably Bangladesh, India, Indonesia, and Pakistan).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Infoblox disclosed its findings on the large-scale push-notification scam network, including its low estimated monetization, heavy concentration of victims in South Asia, and abuse of dormant domains through 'Sitting Ducks' conditions. The report warned organizations to maintain DNS hygiene to reduce the risk of domain takeover.
Over a period described as several days to two weeks, the researchers gathered more than 57 million log records from thousands of victim devices, with peak collection around 30 MB per second. The telemetry showed victims receiving roughly 140 deceptive notifications per day on average and provided insight into the campaign's global reach and tactics.
Infoblox researchers legitimately reclaimed the misconfigured domain through the DNS provider and pointed it to infrastructure they controlled. Without altering victim devices or interacting with attacker systems, they were able to passively receive traffic intended for the scam operation.
One of the actor's domains was abandoned but retained active name server delegation, creating a 'Sitting Ducks' or lame-delegation takeover condition. This DNS hygiene failure allowed the domain to stop resolving normally while still presenting an opportunity for third-party re-registration and control.
A malvertising operation used deceptive websites to trick users, primarily Android Chrome users, into granting browser notification permissions. The campaign then sent fake security alerts, gambling lures, financial-brand impersonations, celebrity/news scams, and adult-content messages in more than 60 languages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers said a threat operation dubbed **Pushpaganda** manipulated Google Discover on Android and Chrome to lure users into enabling malicious browser push notifications. The campaign relied on **113 actor-controlled domains** publishing AI-generated, sensational news pages that mimicked legitimate content and used social-engineering themes including fake government deposits, tax notices, arrest warrants, missed calls, and bank alerts. HUMAN’s Satori Threat Intelligence and Research Team reported the activity first focused on India before expanding to Australia, the United States, and other regions. Once users landed on the pages, deceptive prompts and buttons pushed them to subscribe to notifications, while JavaScript-based tab rotation opened additional domains to inflate traffic and advertising revenue. At its peak, the operation generated roughly **240 million bid requests in seven days**, indicating a large-scale ad fraud component alongside the notification abuse. Researchers shared the infrastructure with Google, which said it deployed a fix to prevent this type of manipulative low-quality content from appearing in Discover feeds.
Jun 29, 2026
Multiple active fraud and malware operations are abusing *trusted themes and brands* to compromise users, with a heavy emphasis on mobile-first delivery via social engineering. Zimperium reported a **targeted Android spyware** operation delivered through a fake “dating” app promoted via social media and messaging links; once installed, the app requests broad permissions (e.g., SMS, contacts, media) to enable **surveillance and data exfiltration** including messages, location, and credentials. Separately, Zimperium also described an Android campaign that **hides a RAT inside artifacts presented as legitimate AI/ML components** hosted on trusted framework infrastructure, enabling attackers to bypass basic screening and gain persistent device control (data theft, screen capture, remote command execution). In parallel, CybersecurityNews summarized two public-service impersonation campaigns tied to “traffic ticket” lures. In India, attackers are mimicking **RTO e-challan** notifications distributed via WhatsApp and other messaging platforms to push off-store Android apps that steal financial and personal data; the malware reportedly uses a **three-stage modular architecture**, dynamic remote configuration, anti-analysis, and a **custom VPN tunnel** to conceal C2 and exfiltration, while prompting victims for high-risk permissions and to disable battery optimization for persistence. In Canada, a separate operation uses **SEO poisoning** and SMS/ad lures to drive victims to **fake provincial traffic ticket payment portals** (e.g., BC, Ontario, Quebec) that harvest PII and payment card data; Unit 42 attributed the activity to a broader fraud network using a phishing kit with a “waiting room” feature and infrastructure spanning **70+ domains**, including concentration on the `45.156.87.0/24` netblock.
Jun 29, 2026
Infoblox researchers reported a widespread **DNS hijacking** campaign targeting **outdated consumer/home routers** across **more than three dozen countries**, where attackers compromise devices and change router-level DNS settings to silently redirect all connected users’ traffic. The manipulated DNS queries are sent to malicious resolvers hosted by **Aeza International**, a **Russian bulletproof hosting provider** that the US sanctioned in **July 2025**, allowing threat actors to control where victims are routed while keeping common destinations working to reduce suspicion. The infrastructure reportedly uses a **two-stage redirection chain**: DNS traffic is forwarded into an **HTTP-based Traffic Distribution System (TDS)** that first verifies the request originates from a compromised router and then fingerprints/filters victims before sending them onward—often into **advertising/affiliate networks** that can lead to **scams or malicious sites**. Analysts also described an evasion behavior where the rogue resolvers may only respond under specific query conditions (e.g., when **EDNS0** is disabled), complicating reproduction and detection; user-visible symptoms included selective site failures and persistent redirects that victims often misattributed to endpoints rather than the router.
Jun 29, 2026