Loading story…
Attackers compromised the Thai educational domain km.chpc.ac.th, injected a casino-themed page, and leveraged the institution’s established search reputation to rank the page for targeted Google queries. Users who selected the Google result were routed through the legitimate-but-compromised college site before being redirected to an illegal online gambling operation.
ADEX described the technique as domain borrowing: abusing trusted government, educational, and country-code domains instead of relying on overtly malicious infrastructure. The Google-result-to-compromised-domain redirect chain can evade conventional advertising review and cloaking detection without custom cloaking code; defenders should inspect complete redirect paths and treat restricted institutional domains appearing in them as indicators requiring investigation and campaign reassessment.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
An academic crawl of Indonesian domains found 147 compromised sites and 346 pages containing gambling keywords. The .ac.id zone was the most affected, with 65 compromised sites.
Google strengthened its site-reputation-abuse policy by removing an exemption for site owners who claimed they were not involved in the abuse.
Google introduced a site-reputation-abuse policy intended to address abuse of a site's established search reputation.
Vietnam reportedly identified similar abuse of .gov.vn and .edu.vn domains, with repeated targeting attributed in part to inadequate cybersecurity investment at public institutions.
cSide identified a campaign affecting more than 500 government and university websites globally, injecting gambling and adult links that were hidden from human visitors but exposed to search crawlers.
Indonesia's Ministry of Communication and Informatics reportedly blocked 683 government and educational websites carrying gambling content, including 461 .go.id and 222 .ac.id domains.
Thailand's Ministry of Digital Economy and Society reportedly identified about 30 million gambling-related URLs across roughly 1,000 public-sector sites. Thailand's Ministry of Public Health reportedly accounted for about 8 million injected gambling-related scripts.
ADEX's traffic-monitoring team identified the campaign after observing advertiser traffic routed through a Google search-results page. ADEX characterized the use of a trusted compromised college domain in the redirect chain as domain borrowing.
Attackers compromised km.chpc.ac.th, planted a casino-themed page that Google indexed prominently, and redirected users who clicked the result to an online gambling site illegal to advertise in Thailand.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a large-scale SEO poisoning campaign that hijacked abandoned cloud DNS delegations to publish Thai-language gambling pages on legitimate corporate subdomains belonging to 163 organizations in more than 30 countries. The activity primarily abused orphaned **Azure DNS** zones, though investigators also observed stale configurations involving DigitalOcean, wildcard misconfigurations, and a Verizon-linked cluster with more than 1,000 deceptive `A` records. Victims included government agencies, hospitals, banks, universities, and critical infrastructure providers, and 161 of the 163 organizations were still actively compromised when the findings were published. The operators reclaimed forgotten DNS zones, added wildcard or bulk DNS records, obtained valid **Let’s Encrypt** wildcard certificates, and deployed a consistent **Next.js** gambling kit that made the pages appear trustworthy to users, browsers, and search engines. Investigators linked the infrastructure through shared favicons, redirect paths, certificates, JARM fingerprints, HTTP body hashes, and Chinese-language management artifacts, tracing delivery nodes and a 103-server backend network in Hong Kong that supported affiliate gambling domains and referral codes such as `link99`, `ibiza99vip1`, `bigwinv1`, and `seven77vip1`. The campaign relied on DNS hygiene failures rather than malware or application exploits, with server-side geographic filtering used to redirect Thai users to gambling destinations.
Jul 12, 2026
Check Point Research reported that the Chinese-speaking **Gambling Goblin** cybercrime cluster has compromised Brazilian government, educational, and commercial Linux web servers since mid-2025. The operators install malicious Apache modules that covertly reverse-proxy traffic from trusted victim domains to fake Google Play, Microsoft Store, and Amazon-branded gambling and betting pages, abusing the victims’ reputations to manipulate search-engine rankings at scale. The group uses an obfuscated Linux toolkit including DownPro, ChUser, PasswordHarvester, AlphaAgent, oRAT, an SSH brute-forcer, and reconnaissance utilities to steal credentials, maintain persistence, move laterally, and remotely administer compromised hosts. Researchers assess with medium-to-high confidence that Gambling Goblin is linked to **Earth Berberoka**, citing shared oRAT code, Chinese-language artifacts, gambling-focused operations, lookalike-domain techniques, and overlapping Amazon-hosted infrastructure; associated systems also host Vietnamese, Spanish, and English phishing content and generate domains daily, creating capacity to expand internationally or distribute malware.
Sep 8, 2026
Fortra disclosed a phishing campaign dubbed **Chameleon SEO Poisoning** that manipulates Google and Bing results to steer users searching for financial services to fraudulent banking login pages. The operation uses recently registered typosquat and lookalike domains, including private second-level domain patterns such as `.ph.com` and `.gr.com`, to impersonate major financial institutions and capture customer credentials. Fortra’s FIRE team said it tracked the activity for three months and observed a **40% increase** in cases during Q2 2026. The campaign relies on cloaking and server-side presentation control to evade detection: users arriving from poisoned search results are shown convincing bank portals, while direct visitors, automated scanners, registrars, and hosting providers may see inactive or benign pages instead. Researchers said the tactic shifts phishing away from email and SMS toward search-driven victim acquisition at the moment users intend to log in, and urged defenders to test suspicious URLs with referrer spoofing and browser emulation, monitor branded search rankings and newly registered lookalike domains, and accelerate takedowns tied to suspicious second-level domain abuse.
Aug 24, 2026