Loading story…
Proofpoint reported that malvertising campaigns were using domain shadowing to hide traffic redirection infrastructure and deliver the Angler Exploit Kit. Attackers abused legitimate domain registrar accounts to create large numbers of malicious subdomains under trusted parent domains, making the activity harder to detect and block while funneling victims from online advertisements to exploit landing pages.
The technique allowed threat actors to rapidly rotate subdomains and maintain resilient redirect chains that blended into normal web traffic. By pairing malvertising with compromised domain management accounts, the operators increased the effectiveness of Angler EK delivery and complicated defensive efforts that relied on domain reputation or simple blacklist-based blocking.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Proofpoint published research describing malvertising campaigns that used domain shadowing to direct victims to the Angler Exploit Kit. The publication publicly revealed the technique and campaign details as a threat development.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported strong operational links between the **Angler Exploit Kit** and the **Bedep** malware downloader, connecting landing pages, redirectors, Bedep DGA command-and-control domains, and payload infrastructure through shared registrant details, email accounts, domain patterns, and reused web content. The investigation, which began around exploitation tied to Adobe Flash zero-day `CVE-2015-0310`, found that Angler instances distributing Bedep were often separate from those directly serving ransomware, but infected hosts could later be funneled to other Angler infrastructure for additional payloads. Traffic analysis from a pseudo-Darkleech campaign showed that compromised web content redirected victims to an Angler server at `185.118.66[.]154`, where exploitation led to **Bedep** infection followed by **CryptXXX** ransomware on a normal host. Researchers also observed Bedep using anti-VM behavior: in virtualized environments it contacted `95.211.205[.]228`, downloaded different malware, and did not deliver CryptXXX, while related activity included click-fraud traffic and execution of a dropped `svchost.exe` file identified as `rundll32.exe` to launch the CryptXXX DLL.
Aug 15, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026