Loading story…
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized Keitaro, a self-hosted ad-tracking platform, across an ecosystem of roughly 15,500 malicious domains, including about 9,000 registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as FaiKast using deepfake news-style cryptocurrency ads, WickedWally targeting U.S. seniors with fake benefits and debt-relief offers, and FishSteaks running giveaway scams impersonating consumer brands.
Netskope separately documented a parallel TDS-for-hire operation built around more than 12,700 fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom Elixir/Phoenix routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included Legion Loader, a reseller TDS gate linked to yfdpco domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Confiant and Infoblox began a four-month analysis of criminal abuse of Keitaro on October 1, 2025. The study later identified a large ecosystem spanning 15,500 malicious domains and multiple scam clusters.
Since August 2025, Confiant reported more than 100 domains tied to criminal abuse of the Keitaro tracker to Apliteni, the company behind Keitaro. Apliteni responded to each report and ultimately canceled more than a dozen threat actor accounts.
Netskope said the earliest directly analyzed samples from the FakeCaptcha PDF campaign were submitted in May 2025. These samples were part of clusters later tied to a large traffic-distribution operation.
In March 2025, Palo Alto Unit 42 documented berapt-medii[.]com serving a fake CAPTCHA that instructed victims to run a command that installed an MSI named Klio Verfair Tools, which dropped Legion Loader. Netskope later linked this site to the broader FakeCaptcha traffic-distribution operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcenetskope.com
Open sourceblog.confiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale campaign has impersonated popular open-source and freeware projects, including **Ghidra**, **dnSpy**, and **SpiderFoot**, to capture search traffic and hijack software download clicks. Researchers found that the fake sites use CloudFront-hosted JavaScript to intercept a visitor’s first interaction and send users into a gated Traffic Distribution System (TDS) that performs anti-bot screening, VPN and datacenter filtering, click confirmation, and frequency capping before deciding what content to serve. The infrastructure appears primarily built for traffic acquisition and monetization, but selected victims were repeatedly routed into malware delivery chains. Those chains included **SessionGate**, a heavily obfuscated multi-stage framework with strong anti-analysis protections that mainly delivered potentially unwanted applications, as well as **RemusStealer** and **AnimateClipper**, which were used to deploy an infostealer and a cryptocurrency clipper. Researchers said the operation has been active since at least late 2025, with active malware distribution observed from early 2026 and more than **5,000** VirusTotal submissions indicating significant scale.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026
Multiple reports detail **social-engineering-driven malware delivery** that results in **remote access trojans (RATs)** and credential theft. Infoblox described observing an affiliate push-notification ad network after exploiting misconfigured DNS delegations (“**Sitting Ducks**”/lame name server delegation) to take over abandoned threat-actor domains, allowing collection of **~57M logs** over two weeks and visibility into widespread **scams and brand impersonation** delivered via push ads. Nextron Systems separately reported recurring **malvertising** chains where “free converter” tools (e.g., document/image converters) downloaded from ads on legitimate sites function as advertised while covertly installing **persistent RATs**, with common artifacts such as Windows **Mark-of-the-Web** (`ZoneId=3`) indicating internet origin. Other activity in the set reflects different initial-access lures but the same general outcome—RAT-style access and data theft. Fortinet analyzed a **phishing** campaign using a fake Vietnam shipping document: a Word attachment leads to an RTF stage that exploits an RTF-related vulnerability, then uses **VBScript/PowerShell** to load a **fileless .NET module**, ultimately downloading and injecting a **Remcos** variant (including process hollowing) to provide full remote control. Separately, reporting on North Korea’s **“Contagious Interview”** campaign described fake recruiter outreach (e.g., via LinkedIn) that tricks developers into opening malicious code repositories; execution can be triggered via a hidden **VS Code `tasks` configuration**, server-side logic hooks, or a malicious npm dependency to steal credentials/crypto wallets and establish persistence—this is thematically similar (social engineering leading to remote access) but is a distinct operation from the malvertising/push-ad and Remcos phishing activity.
Jun 29, 2026