Loading story…
Security researchers reported that a cloaking platform called 1Campaign is enabling cybercriminals to run malicious Google Ads while evading Google’s ad review and many security scanners. The service uses cloaking to present a benign “white page” to reviewers, researchers, and automated analysis systems, while redirecting real users to attacker-controlled destinations such as phishing pages, fake software download sites, and cryptocurrency drainer scams. The platform has reportedly been active for at least three years and is operated by an individual using the handle “DuppyMeister,” with support and operations facilitated via Telegram channels.
Reporting describes 1Campaign as a packaged, user-friendly dashboard that lowers the barrier to entry for ad-based fraud by providing real-time visitor filtering and fraud/risk scoring, including blocking traffic associated with cloud providers and security vendors. Observed campaigns demonstrated extremely selective targeting (e.g., blocking ~99.4% of visitors in one case; another campaign processed 1,676 visitors while allowing only 10 through), and filtering based on geography, ISP, and device characteristics to keep campaigns live longer. The service also includes tooling intended to help launch Google Ads and impersonate legitimate brands, underscoring that static URL scanning is often insufficient against dynamic cloaking and that defenders should expect more victim-specific delivery in malvertising operations.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Varonis Threat Labs disclosed technical details on 1Campaign, describing how it shows benign pages to Google reviewers and automated scanners while redirecting real users to phishing, fake download, and crypto-drainer pages. The report highlighted the platform's dashboard, fraud scoring, bot filtering, and brand-impersonation capabilities that help malicious ads remain active for extended periods.
In an observed campaign tied to bitcoinhorizon.pro and labeled "Blockbyblockchain," 1Campaign was used to aggressively screen traffic and allow only a tiny fraction of visitors through to malicious content. Researchers said the system blocked 99.4% of 1,676 visitors, demonstrating highly selective targeting against intended victims while excluding researchers and security infrastructure.
The malvertising enablement platform 1Campaign was reported to have been active for at least three years, operated by a developer using the handle "DuppyMeister." It offered infrastructure for cloaking, visitor filtering, and Google Ads abuse to help threat actors evade review systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cloud-hosted tech-support scam campaign used more than 250 Google Ads campaign IDs to route users through a benign-looking fake “ShopEase” storefront before presenting operating-system-specific security lockers impersonating Microsoft Defender on Windows and Apple on macOS. Between August 31 and September 14, it affected at least 619 organizations, chiefly in the United States, Japan, and Australia, with ads appearing across at least 284 legitimate publisher sites. Victims were pressured to call a fraudulent support number through full-screen browser takeovers, keyboard locking, hidden cursors, warning audio, and intentional browser-performance degradation. The campaign reflects advanced browser-based scareware techniques also documented in CypherLoc, which uses encrypted JavaScript loaders to validate, decrypt, and execute concealed payloads before replacing the initial page with a fake security warning. Such lockers evade automated inspection through interaction checks such as required mouse movement and staged AES decryption of command-and-control details and payloads, while assembling the malicious interface entirely in browser memory. They can further heighten credibility by displaying a victim’s public IP address and fake login forms, while repeatedly relocking the browser when users attempt to recover control.
Sep 28, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026