This threat involves three financially motivated groups acquiring expired malicious domains via dropcatch services to capitalize on existing traffic from previously compromised sites. Stuffy Squirrel operates since 2020, embedding malicious activity within legitimate scripts and selling traffic to affiliate advertising networks. Shady Squirrel employs custom JavaScript and Keitaro injections with multi-step cloaking, collaborating with initial access brokers to deliver tech support scams and SocGholish malware, contributing to SocGholish's resurgence after Operation Endgame disruption. Swiping Squirrel sells fraudulent traffic to zero-click advertising platforms like ZeroPark, leading to malvertising and malware distribution. Collectively, these actors control thousands of domains, leveraging lingering infections without launching new compromises. The activity is linked to multiple tactics and techniques such as phishing, command and control communications, and obfuscation.

The threat actors monetize expired malicious domains by inheriting traffic from previously compromised websites, enabling continued distribution of tech support scams, malvertising, affiliate fraud, and malware such as SocGholish. This results in sustained exposure of users to fraudulent and malicious content without new exploitation campaigns. The persistence of these domains facilitates ongoing financial gain for the actors and continued risk to users interacting with these domains. The threat is notable in the United States and Japan but is not limited to these regions.

No direct patch or fix applies as this threat exploits expired domains rather than software vulnerabilities. Mitigation should focus on monitoring and blocking known malicious domains listed in threat intelligence feeds. Organizations should update domain blocklists to include the identified domains and educate users about risks associated with tech support scams and malvertising. Network defenders should leverage domain reputation services and DNS filtering to reduce exposure. Since the actors do not conduct new attacks but exploit residual infections, remediation of previously compromised assets remains critical.