Loading story…
Infoblox Threat Intel reported that cybercriminals are increasingly exploiting expired "dropcatch" domains as a large-scale abuse channel, with roughly 65,000 re-registered dropped domains observed per day in the first half of 2026—about 20% of newly seen domains. Because these domains retain backlinks, reputation, residual traffic, and sometimes dangling DNS relationships, attackers can revive them for scams, traffic monetization, malware delivery, and redirection without first compromising new infrastructure. Researchers said actors including Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel collectively control thousands of such domains, using cloaked traffic distribution, ad-tech chains, affiliate programs, and custom injections to steer victims to tech-support scams, gambling offers, SocGholish, and other malicious content.
The most prominent operation, Sable Squirrel, was described as a sprawling network controlling more than 10,000 domains tied to illegal sports streaming, betting promotion, traffic redirection, and malware command-and-control, with estimated domain spending exceeding $7 million. Infoblox identified more than 31,000 malware samples communicating with Sable Squirrel infrastructure, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples with HiddenTear signatures, while some binaries carried the actor’s own brands such as socolive, xoilac, and 8xbet in PE metadata. Researchers said the actor repurposed hundreds of streaming domains into dual-use malware infrastructure beginning in late 2025, likely overlapping with the Vietnamese Xoi Lac TV ecosystem, and that related actors have also redirected visitors from major media sites and partnered with downstream malware operators such as TA569 after disruptions to earlier criminal infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
22 events from the most recent confirmed update back to the earliest known activity.
Infoblox reported that Sable Squirrel spent nearly $7 million acquiring more than 10,000 expired domains used across illegal sports streaming, gambling promotion, and malware infrastructure. The disclosure quantified the scale of the actor's domain acquisition campaign and linked it to brands including Xoilac, Cakhia, and 90phut.
On August 13, 2026, Infoblox Threat Intelligence published research describing three previously undocumented dropcatch actors—Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel—that re-register expired malicious domains embedded in compromised websites to inherit and monetize victim traffic. The report identified Swiping Squirrel as the most prolific of the three and said its zero-click advertising chains often led to scams or malware.
Infoblox reported that Shady Squirrel started sending traffic to SocGholish in July 2026 after the tech support scam activity ceased.
Infoblox said the tech support scam actor in Shady Squirrel's chain, which abused Microsoft Azure static web hosting and created nearly 10,000 accounts per month, went silent in early July 2026.
Infoblox reported that Operation Endgame disrupted SocGholish in mid-June 2026 by seizing or cleaning more than 300 servers and 140 domains and freezing more than 41 million euros in cryptocurrency assets.
Infoblox said the tech support scam campaigns in Shady Squirrel's redirection chain were first seen in April 2026 and targeted victims in Japan and the United States with fake Microsoft warnings.
Infoblox said Sable Squirrel ceased using AsyncRAT on March 3, 2026, after which DCRat became the actor's primary malware payload.
Infoblox reported that in March 2026, Vietnamese authorities charged 30 suspects and seized roughly 300 billion Vietnamese dong in assets in the Xoi Lac TV case.
Infoblox reported that Vietnamese authorities froze flagship sites linked to the Xoi Lac TV network in February 2026 as part of enforcement against the operation overlapping with Sable Squirrel.
Infoblox described a February 2026 incident in which Shady Squirrel acquired an expired CDN domain previously used by a marketing service and redirected visitors from major media websites to malware.
Infoblox reported that during the first half of 2026 it observed about 50,400 re-registered dropped domains per day across gTLDs and roughly 65,000 per day when ccTLDs were included, representing about one in five newly observed domains.
Infoblox reported that December 2025 accounted for 86% of the observed malware weaponization wave on Sable Squirrel domains, with a peak of 386 active malware C2 domains.
Infoblox said that since November 2025, gsstats[.]ru has served as Stuffy Squirrel's primary entry point, replacing tofuturepubs[.]com.
Infoblox reported that the first Sable Squirrel malware command-and-control configurations appeared in November 2025, when the actor began repurposing streaming domains for malware operations.
Infoblox said the earliest file carrying Sable Squirrel's AsyncRAT signature appeared on November 1, 2025, marking the start of observed malware use on its domain infrastructure.
Infoblox identified a small cluster of Quasar samples dated to October 12, 2025, suggesting pre-deployment testing on infrastructure later tied to Sable Squirrel.
Infoblox said that since March 2025, Stuffy Squirrel continued using ExoClick while shifting from PushHouse to an unidentified Russian popunder advertising network.
Infoblox reported that through January 2025, Stuffy Squirrel monetized traffic as a publisher in PushHouse while also running ExoClick popunder ads.
Infoblox said Shady Squirrel has operated since at least July 2023 and has acquired more than 700 domains since 2023 for cloaked traffic distribution and malicious redirection.
Infoblox assessed that Sable Squirrel started acquiring expired dropcatch domains as early as June 2023, marking the beginning of the domain-purchase activity later tied to its streaming, gambling, and malware infrastructure. The report described this as part of a two-track model using both auctioned expired domains and freshly registered lookalike domains.
Infoblox reported that the dropcatch actor it tracks as Stuffy Squirrel has been continuously active since at least 2020, operating traffic-distribution infrastructure across multiple generations.
Infoblox and Eclypsium reported that Spammy Bear was the earliest known threat actor using the Sitting Ducks domain hijacking technique, beginning in late 2018 at GoDaddy. The report says the technique has since been used to hijack tens of thousands of domains for malicious operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourceinfoblox.com
Open sourceinfoblox.com
Open sourceinfoblox.com
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks reported widespread abuse of cybersquatting domains that imitate major brands including **Facebook, Apple, Amazon, Netflix, Microsoft, Samsung, Walmart, and Wells Fargo** to conduct phishing, malware delivery, command-and-control, technical support fraud, reward scams, re-bill scams, and parked-domain monetization. In one month of observation, researchers identified **13,857** squatting domains—about **450 per day**—with **2,595** classified as malicious and **5,104** as suspicious or high risk, showing how frequently newly registered lookalike domains are weaponized against consumers. The activity used multiple squatting techniques, including **typosquatting, combosquatting, homograph-squatting, soundsquatting, bitsquatting, and level-squatting**, and often targeted profitable sectors such as search, social media, shopping, finance, and banking. Examples included `secure-wellsfargo[.]org` for phishing, `samsungeblyaiphone[.]com` for **Azorult** malware distribution, `microsoft-store-drm-server[.]com` for C2 activity, `microsoft-alert[.]club` for a technical support scam, and `netflixbrazilcovid[.]com` for a re-bill scam; researchers also found that more than half of the malicious or high-risk domains were not detected by any VirusTotal vendors during the comparison window, underscoring significant detection gaps and the need for continuous monitoring of newly registered domains and passive DNS data.
Aug 14, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
Threat actors are using **compromised or spoofed websites** to trick victims into executing malware, with lures ranging from fake browser updates to counterfeit security-software download pages. Recorded Future’s Insikt Group reported that financially motivated **GrayCharlie** (overlapping with **SmartApeSG**) compromised multiple U.S. law-firm WordPress sites—potentially via a shared IT/marketing provider—and injected externally hosted JavaScript that redirected visitors to **bogus update pages** or **fake CAPTCHA** flows. Victims were prompted to run a PowerShell command via the Windows Run dialog, leading to **NetSupport RAT** installation and follow-on delivery of **Stealc** and **SectopRAT**; the operation’s infrastructure was noted as being supported by **MivoCloud** and **HZ Hosting Ltd.** Separately, Malwarebytes-linked reporting described a **typosquatting** campaign impersonating the Huorong antivirus site (`huoronga[.]com` vs. `huorong.cn`) to distribute **ValleyRAT** (built on the **Winos4.0** framework), attributed to the Chinese-speaking **Silver Fox APT**; the payload was routed through an intermediary domain and hosted on **Cloudflare R2**, with a ZIP masquerading as Huorong (`BR火绒445[.]zip`). In a different region and access vector, Group-IB reported Iran-linked **MuddyWater** running **Operation Olalampo** against MENA targets using **phishing emails** with malicious Office documents/macros to deploy new tooling including **GhostFetch** (dropping **GhostBackDoor**) and **CHAR** (a Rust backdoor controlled via a **Telegram bot**), plus variants using **HTTP_VIP** to deploy *AnyDesk*; the campaign also leveraged recently disclosed vulnerabilities on public-facing servers for initial access.
Jun 29, 2026