Loading story…
A media-buying investment-fraud operation targeting South Africans used the domain boroxior[.]pro to host eight fraudulent landing pages impersonating local news outlets, Bloomberg, and the South African government. The pages promoted fabricated endorsements attributed to figures including Elon Musk, Cyril Ramaphosa, Enoch Godongwana, Patrice Motsepe, Johann Rupert, Christo Wiese, and Julius Malema, then collected prospective victims' details through investment lead forms.
An operational-security failure exposed a public ZIP archive containing the campaign backend and landers. The operators used Keitaro traffic filtering hosted at lonvexo[.]xyz to show benign content to bots, reviewers, VPN users, and visitors outside the intended geography while routing probable South African victims to the scams; submitted data was sent to a CRM at 62.60.226[.]45, conversion-tracking services, advertising pixels, and a hardcoded Telegram bot and chat. The infrastructure and landing-page fingerprints link the activity to a broader affiliate or shared-toolkit ecosystem that has also supported fraudulent campaigns against European targets.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers identified a cloaked investment-fraud operation on boroxior[.]pro targeting South African users after finding a publicly exposed ZIP backup containing its backend and eight branded fraudulent landing pages. The operation used Keitaro-based filtering via lonvexo[.]xyz to serve decoys to bots, reviewers, VPN users, and non-target geographies while routing likely victims to lead-capture forms.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
Infoblox reported that the **VexTrio** cybercriminal network operated a large traffic distribution and scam-enablement ecosystem that relied on DNS manipulation, compromised routers, and hosting infrastructure to steer victims to malicious content. The reporting links VexTrio to **Savvy Seahorse**, a campaign that used Facebook ads and fake investment brands to lure users onto fraudulent trading platforms, with DNS services helping conceal the underlying infrastructure and redirect traffic through intermediary domains and systems. A later Infoblox investigation said the operation also leveraged **compromised SOHO routers**, a **traffic distribution system (TDS)**, and infrastructure associated with **Aeza Networks** to mask backend services and route victims based on geography, device, or campaign logic. Together, the findings describe a resilient criminal ecosystem that blended ad-driven social engineering with covert DNS and network-layer redirection to support investment fraud and other malicious web operations at scale.
Jul 12, 2026
Threat researchers reported coordinated spearphishing activity targeting energy, oil and gas, electronics, and related supply-chain organizations, with notable focus on South Korean firms and entities in the UAE and Qatar. The lures impersonated legitimate business correspondence using spoofed or typosquatted email accounts and referenced real tenders, RFQs, procurement documents, executives, and major projects such as **ADNOC** and **Doha airport** work to increase credibility. The emails delivered malicious `IMG`, `ISO`, `CAB`, `PDF`, `ZIP`, and .NET loader chains, often hosted through legitimate services including **WeTransfer** and **Mega**, to install information-stealing malware such as **AZORult**, **Agent Tesla**, **Formbook**, **Loki**, and **Snake Keylogger**. Researchers said the malware was used to steal credentials, banking and browsing data, and keystrokes, while some samples used fileless execution, anti-analysis checks, and process hollowing to evade detection; one campaign also appeared to target suppliers as a path to compromise trusted downstream business relationships.
Aug 15, 2026