Loading story…
A new free service called DecryptAds has launched to expose which companies can serve ads or collect data on websites and mobile apps by scraping and correlating public adtech disclosure files, including ads.txt, app-ads.txt, buyers.json, and sellers.json. The platform is designed to help researchers investigate malvertising, data brokers, AI-generated low-quality sites, and adtech partners tied to higher-risk jurisdictions such as Russia, China, Cyprus, and the UAE. It also offers legal dossiers and a quiet removals feed to help trace seller IDs, ownership links, and silent removals from ad exchanges.
Reporting on the service highlighted examples involving espn.com, several U.S. military news sites, Opera.com, and infrastructure linked to the Fengwo Group, showing how DecryptAds can surface extensive adtech relationships and geo-risk connections, including entities such as Between Digital. The coverage argues that malicious advertising is increasingly appearing on AI-generated “slop” sites and says broader sharing of ad supply-chain object data by major ad networks would improve attribution of harmful ads. Practical defenses cited include using ad blockers and limiting mobile app use to reduce tracking and exposure to malicious advertising.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The sources describe Alfa Bank as a Russian bank sanctioned by the United States in 2022 after Russia invaded Ukraine. The bank is mentioned because Between Digital's publisher offers are processed through it.
The article states that Opera has been majority owned and controlled by the Chinese company Kunlun Tech since 2016.
DecryptAds is described as a newly launched free service that scrapes and correlates public adtech disclosure files such as ads.txt, app-ads.txt, buyers.json, and sellers.json to expose which companies can serve ads or collect data on websites and apps.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that a cloaking platform called **1Campaign** is enabling cybercriminals to run **malicious Google Ads** while evading Google’s ad review and many security scanners. The service uses cloaking to present a benign “white page” to reviewers, researchers, and automated analysis systems, while redirecting real users to attacker-controlled destinations such as **phishing pages**, **fake software download sites**, and **cryptocurrency drainer** scams. The platform has reportedly been active for **at least three years** and is operated by an individual using the handle **“DuppyMeister,”** with support and operations facilitated via Telegram channels. Reporting describes 1Campaign as a packaged, user-friendly dashboard that lowers the barrier to entry for ad-based fraud by providing real-time visitor filtering and fraud/risk scoring, including blocking traffic associated with cloud providers and security vendors. Observed campaigns demonstrated extremely selective targeting (e.g., blocking **~99.4%** of visitors in one case; another campaign processed **1,676** visitors while allowing only **10** through), and filtering based on geography, ISP, and device characteristics to keep campaigns live longer. The service also includes tooling intended to help launch Google Ads and impersonate legitimate brands, underscoring that static URL scanning is often insufficient against dynamic cloaking and that defenders should expect more victim-specific delivery in malvertising operations.
Jun 29, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
HUMAN's Satori Threat Intelligence and Research Team disclosed an Android ad fraud and malvertising operation dubbed **Trapdoor** that relied on **455 malicious apps** and **183 threat actor-controlled command-and-control domains**. The apps were disguised as common utilities such as PDF readers, file managers, and device cleanup tools, then prompted users to install fake software updates or secondary apps. Those follow-on payloads used hidden embedded browsers and WebViews to load malicious HTML5 content in the background, generating fraudulent ad impressions, clicks, and bid requests without the victim's knowledge. Researchers said the scheme was effectively self-funding, turning seemingly legitimate installs into an illicit advertising revenue loop that financed further malvertising. At its peak, Trapdoor generated up to **659 million bid requests per day** and was tied to more than **24 million fraudulent app installs**. The malware also used install attribution services and download-origin checks to activate malicious behavior mainly for users acquired through the actors' own ad campaigns while suppressing activity for organic installs, helping it evade detection. Most observed traffic came from the United States, with additional activity seen in Japan, Australia, Russia, New Zealand, India, and elsewhere; after responsible disclosure, Google removed the identified apps from Google Play.
Jun 29, 2026