Three financially motivated threat actor groups acquire expired malicious domains to inherit traffic from existing website compromises, redirecting victims to scams, malware, and affiliate advertising networks. Stuffy Squirrel hides malicious JavaScript in legitimate scripts with multi-layered evasion. Shady Squirrel partners with initial access brokers and enabled SocGholish's return after law enforcement disruption. Swiping Squirrel sells fraudulent traffic to zero-click advertising platforms where victims encounter malware. Combined, these actors control thousands of domains embedded in tens of thousands of compromised sites.
TDS
8 posts
Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows Hot Take: Operation Endgame vs. SocGholish Operation Endgame successfully disrupted the SocGholish (TA569) initial access framework, which relies on compromised WordPress sites and Traffic Distribution Systems (TDS) to deliver fake browser updates. The threat actor utilizes domain shadowing and a multi-stage JScript payload to establish footholds, primarily targeting corporate environments during standard work weeks to facilitate follow-on ransomware deployment.
Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem Check Point Research uncovered a large-scale malware distribution ecosystem that uses search engine optimization and impersonated open-source project sites to drive traffic to a sophisticated Traffic Distribution System (TDS). The TDS employs click hijacking and strict gating to selectively deliver malware, including the SessionGate loader, RemusStealer, and AnimateClipper, while actively evading automated analysis through one-time key releases and file inflation.
Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs Threat actors are utilizing Traffic Distribution Systems (TDS) to direct mobile users to fake CAPTCHA pages that trick them into sending premium international SMS messages. This International Revenue Share Fraud (IRSF) scheme leverages social engineering and back button hijacking to generate multiple SMS messages per victim, resulting in significant financial charges.
Patterns, Pirates, and Provider Action: What We Learned Working with Keitaro Cybercriminals are widely abusing the Keitaro ad tracking software as a Traffic Distribution System (TDS) to route victims to malware, crypto drainers, and scams. By utilizing cracked licenses, advanced traffic filtering, and third-party cloaking integrations, threat actors effectively evade detection while precisely targeting users based on device and geolocation.
Widespread GitHub Campaign Uses Fake VS Code Security Alerts to Deliver Malware A widespread phishing campaign is exploiting GitHub Discussions to distribute fake Visual Studio Code security alerts to developers. The campaign uses fabricated CVEs and mass-tagging to trick Windows users into clicking malicious share.google links, which redirect to a JavaScript fingerprinting and Traffic Distribution System (TDS) hosted on an attacker-controlled domain.
No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution Cybercriminals are increasingly abusing the Keitaro adtech platform to optimize the distribution of malware, phishing, and scams. By leveraging Keitaro's built-in tracking, cloaking, and traffic distribution capabilities, actors can efficiently target victims, evade detection, and scale operations across multiple threat types including wallet drainers and infostealers.
Abusing .arpa: The TLD That Isn’t Supposed to Host Anything Threat actors are utilizing a novel phishing technique that abuses the implicitly trusted .arpa top-level domain and IPv6 tunnels to bypass standard security controls. By registering reverse DNS domains for IPv6 blocks and creating A records instead of PTR records, attackers host malicious content on infrastructure that evades reputation-based blocking and policy filters.
